Overview

overview

9

Static

static

1

SolaraFgyr3wg.zip

windows7-x64

1

SolaraFgyr3wg.zip

windows10-2004-x64

9

S0laraG.zip

windows7-x64

1

S0laraG.zip

windows10-2004-x64

1

readme.txt

windows7-x64

1

readme.txt

windows10-2004-x64

1

Resubmissions

09/09/2024, 15:58

240909-teha8swhmn 9

09/09/2024, 15:55

240909-tcsn7awgmk 1

Analysis

  • max time kernel
    710s
  • max time network
    675s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SolaraFgyr3wg.zip

  • Size

    51.5MB

  • MD5

    4d8f9bcedf3ffb755215e1715d1542e2

  • SHA1

    3c5b28451d50f8701822eec25c427390e0463412

  • SHA256

    3ad72cdbee191f6bb0ce6dff149e3b327f6a081fe360fa06bce5e6d433313eb6

  • SHA512

    46e7e074cc41625f64f29f276eaee44e199ba2e54e5857919f4b2a138d13f9d3a6c2b2c3599d4617198992fbb9526458bba8d500218797daf4abd71de0dc87a6

  • SSDEEP

    786432:9HSwEsBXsW+YBV/Ux1JXTdy02KP2QE+Yj8zhdgayVzD004KHsjFPvwuPyLV1uY0u:nXsdOV/ELpD6QU8cwFPpPW70JPly

Score
9/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 8 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SolaraFgyr3wg.zip
    1⤵
      PID:1512
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
      1⤵
        PID:3188
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4488
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc8d8ade2h52a6h4c74hadachc5b8ca9bb999
          1⤵
            PID:2644
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5948729bh1bddh462ah9c59hdd0898da6ed0
            1⤵
              PID:2500
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
              1⤵
              • System Location Discovery: System Language Discovery
              PID:5048
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:4252
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
              1⤵
              • System Location Discovery: System Language Discovery
              PID:3336
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
              1⤵
              • System Location Discovery: System Language Discovery
              PID:1728
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
              1⤵
                PID:3896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9991d8c0hbbcch4b32h9cc8h0b38780b9eba
                1⤵
                  PID:216
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                  1⤵
                  • System Location Discovery: System Language Discovery
                  PID:4340
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                  1⤵
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:4552
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                  1⤵
                  • System Location Discovery: System Language Discovery
                  PID:4272
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0x510 0x4f4
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3816
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault165db7feh190ch47a0ha8fch2a375d1089e9
                  1⤵
                    PID:3088
                  • C:\Windows\SysWOW64\DllHost.exe
                    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                    1⤵
                    • System Location Discovery: System Language Discovery
                    PID:1948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1684,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
                    1⤵
                      PID:3596
                    • C:\Program Files\7-Zip\7zG.exe
                      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\SolaraFgyr3wg\" -spe -an -ai#7zMap7522:84:7zEvent6485
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      PID:4988
                    • C:\Program Files\7-Zip\7zG.exe
                      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\S0laraG\" -spe -an -ai#7zMap17461:72:7zEvent32192
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      PID:1420
                    • C:\Windows\system32\OpenWith.exe
                      C:\Windows\system32\OpenWith.exe -Embedding
                      1⤵
                      • Modifies registry class
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3724
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\S0laraG\locales\resources\app.asar.unpacked\node_modules\btime\binding.node
                        2⤵
                        • Opens file in notepad (likely ransom note)
                        PID:716
                    • C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe
                      "C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe"
                      1⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1300
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k move Knight Knight.bat & Knight.bat & exit
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:816
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4360
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /I "wrsa.exe opssvc.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3524
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4492
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2044
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c md 51250
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1116
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /V "HospitalityGrayOracleRisk" Select
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1596
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c copy /b ..\Beijing + ..\Collection + ..\Methods + ..\Conducted + ..\Gain + ..\Aye + ..\Fallen + ..\Elements + ..\Alberta + ..\Started + ..\Beliefs w
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2324
                        • C:\Users\Admin\AppData\Local\Temp\51250\Joy.pif
                          Joy.pif w
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:3304
                          • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1528
                        • C:\Windows\SysWOW64\choice.exe
                          choice /d y /t 5
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3796
                    • C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe
                      "C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe"
                      1⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1708
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k move Knight Knight.bat & Knight.bat & exit
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:772
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2908
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /I "wrsa.exe opssvc.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:976
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2480
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4452
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c md 51250
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1956
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c copy /b ..\Beijing + ..\Collection + ..\Methods + ..\Conducted + ..\Gain + ..\Aye + ..\Fallen + ..\Elements + ..\Alberta + ..\Started + ..\Beliefs w
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3744
                        • C:\Users\Admin\AppData\Local\Temp\51250\Joy.pif
                          Joy.pif w
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:5004
                          • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            4⤵
                            • Executes dropped EXE
                            PID:4752
                          • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1060
                        • C:\Windows\SysWOW64\choice.exe
                          choice /d y /t 5
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2172
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
                      1⤵
                        PID:672
                      • C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe
                        "C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe"
                        1⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4552
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k move Knight Knight.bat & Knight.bat & exit
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:4740
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3512
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "wrsa.exe opssvc.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1608
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2116
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2956
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c md 51250
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2692
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /V "HospitalityGrayOracleRisk" Select
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4392
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c copy /b ..\Beijing + ..\Collection + ..\Methods + ..\Conducted + ..\Gain + ..\Aye + ..\Fallen + ..\Elements + ..\Alberta + ..\Started + ..\Beliefs w
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4196
                          • C:\Users\Admin\AppData\Local\Temp\51250\Joy.pif
                            Joy.pif w
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:404
                            • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                              C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4516
                          • C:\Windows\SysWOW64\choice.exe
                            choice /d y /t 5
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2376
                      • C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe
                        "C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe"
                        1⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2972
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k move Knight Knight.bat & Knight.bat & exit
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:3780
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3964
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "wrsa.exe opssvc.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4080
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4892
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4416
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c md 51250
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4376
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c copy /b ..\Beijing + ..\Collection + ..\Methods + ..\Conducted + ..\Gain + ..\Aye + ..\Fallen + ..\Elements + ..\Alberta + ..\Started + ..\Beliefs w
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:3232
                          • C:\Users\Admin\AppData\Local\Temp\51250\Joy.pif
                            Joy.pif w
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:244
                            • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                              C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4396
                          • C:\Windows\SysWOW64\choice.exe
                            choice /d y /t 5
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:376
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                        1⤵
                          PID:4380

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                          Filesize

                          2KB

                          MD5

                          dacc82e6e6b88e8e99998baa34b684c5

                          SHA1

                          c10ffeebbfea0522f5cb3a3afd159d362c90a89a

                          SHA256

                          3961907179b99e833cdd64406120a73363c21cfa05cbbb13826450f71b374046

                          SHA512

                          b2fbd2ace8a9ef986932c90cb5d78ec9fd6a2ab4e8793bb47e879edfab328ca05a34076c1b729f45e861030c85e2f435e215b7144c5c248e48573ba3ade03749

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\51250\Joy.pif
                          Filesize

                          872KB

                          MD5

                          18ce19b57f43ce0a5af149c96aecc685

                          SHA1

                          1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                          SHA256

                          d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                          SHA512

                          a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\51250\RegAsm.exe
                          Filesize

                          63KB

                          MD5

                          0d5df43af2916f47d00c1573797c1a13

                          SHA1

                          230ab5559e806574d26b4c20847c368ed55483b0

                          SHA256

                          c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

                          SHA512

                          f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\51250\w
                          Filesize

                          780KB

                          MD5

                          1b5348a1599210168f5d5ff12b0ce411

                          SHA1

                          8e6e563eca492f5df2d840658968c4a27bce7850

                          SHA256

                          4ce6e0215ed84b96c3d147ca013e97e6631d5991644edd7f2c0b6cf4cec25350

                          SHA512

                          e0f90d52c50c71df5a864ed7643c4733a966870c128d6ccc8572e6b8509abb16cd48fb5be6546de887fa625341ab56745bc03f36e130e5a6295e83c965e77066

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Alberta
                          Filesize

                          55KB

                          MD5

                          cd72c52725b1aa5033c6eb98950b01f6

                          SHA1

                          4f562a2cfc1e6bfd9a014d02465621d2627a8fcb

                          SHA256

                          89f74c6adbe334237876b1c67b1daaa05801987db0156e9f8d5cd5095181db8a

                          SHA512

                          d0638a2af12feaa492d16b658768b3dc9c76864baf160a92c28cfb2a9571d8214f6fbde05c05f66caa215aa9d386ab0712ad830877b0a676e0a3359be75b61fd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Aye
                          Filesize

                          98KB

                          MD5

                          49b03332149aaae0c5c66bfa3d9b214d

                          SHA1

                          51d8abbed0ad2760821c72d48824932ecc272b05

                          SHA256

                          d8e492dc4febcca35259f78dc9793d597d6db802fb0e70aa421bc93fbc6bd61f

                          SHA512

                          563deb69972d01a74cc948fea7a2a16344663b3de6fa4549dc0028c82d98e2070c9c856d927cfbbc0d0ad0bab763d0a336689a007ae2fb9e5bc3c212ba4eab65

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Beijing
                          Filesize

                          54KB

                          MD5

                          5e2d089f89a33af335801f2c31b4243e

                          SHA1

                          04c8b940d3a0784a4023eacc9726bae4e8b4234b

                          SHA256

                          76f9e27ec08943a9ff6b48080be9989766bbb55613c7ee1deb750fc128ce74d1

                          SHA512

                          fe78fc7a7c9d845ff71edb876b6bb0c441dfc69746535e722de5994f64726a18fdc04b51d7f6af70972f65e889d9ff396495058ccfcd93f71e3f6ebffd2fee2a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Beliefs
                          Filesize

                          52KB

                          MD5

                          af6e8b68c585b1cdeb4477f03eca27a4

                          SHA1

                          7ed30e5cb75ffe40952490fe0b892143512015de

                          SHA256

                          21eb0a889e1b4b0ae0a8d7e466c6bd7eebaee19ab8685353c85a858a42c1517b

                          SHA512

                          63e05ed66e8627305ac1b587c365e4aafa32854251ad0cd465cab104136164da68d84d1e23ceb8d82c208b02bf494dca18b31a56aa2cd54a04e68cb8da724ce9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Collection
                          Filesize

                          70KB

                          MD5

                          bdc8c2e3f0206682d7a0320771963cda

                          SHA1

                          cda06d65a2da3b819fb5730ffb69cebc58587fcc

                          SHA256

                          4346ef1a6295ec31e197de3f2931a632dfaa5ab9875f5bf6e4a9a23f44b12a5c

                          SHA512

                          b4a2d3374d4cba5045c483fdcc23e3d4e7a3d0ab9a0c18d7fafd7e4431cf54e2d7ae84b5af2df42d3804b4347bb51394239e90b9eaa992790d165300a519107b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Conducted
                          Filesize

                          75KB

                          MD5

                          9a41d927835d049bcf6314379cc8c775

                          SHA1

                          37b3b502aa7d3b2a80eceecef506048e1dc96bd9

                          SHA256

                          3177807ffa5c1f0e19bbdb906b54e16f05da2943f62abc70db2e1aad51e70e21

                          SHA512

                          c6b75be5ef3f057bb962e3cdb79cf9c2c832e423931238927b8afc6bbf2b3487c68614301a6101b71410f7211454db6b7e09cb465a1979cf283fcf03c7e58c0f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Elements
                          Filesize

                          60KB

                          MD5

                          610036564fff5e8d8493934325f59de7

                          SHA1

                          a2bf604c885ba955fd670e4fc9980b780572e9ec

                          SHA256

                          b5686a8f08197d566f91d6caa87398f0f798604f9ab4a011bb9f604fddb04ec7

                          SHA512

                          60d6bbec574cdc334fb9b14508f11e73e9b15dad67f124fbb81ede70144a2a0a1497a2cd6cdcf4585ed5e15766e0cd944836ecab7314859fc11fc6fe94ccab2f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Fallen
                          Filesize

                          53KB

                          MD5

                          9f9bdb6b14d06bc389b909aaffb31917

                          SHA1

                          da57ba8e3c83f6d38980645d92729c733173a8bc

                          SHA256

                          caa52bd8fa6da9253ff05ed42377dc91ac40729fac32b84d5651e50418008517

                          SHA512

                          0cf1a37d939f8e6dbf51694fb4f948f4e266014e40bf32f510aff77d0a7aa63eb3acc83ed7dab54d7adf1c8832fc77c5f231e98d7fa751d02e3d42dc48cc4989

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Gain
                          Filesize

                          97KB

                          MD5

                          0a605f07fcb9b9e9adfa6bfc6541af3f

                          SHA1

                          15437b552f4d21b83c6f01f4ff915b1e1d5325e1

                          SHA256

                          34f734fef8f49cb06f0178d361fef39526084d036a5be9944b813289fa3e0e9f

                          SHA512

                          b7aa1d875afb2859ad85040e80b4b006067e3b22063f2557e7e565e17d9f59c7afe40fd953031c83c6ea397aa5fcedde374845c9d64f94aaf0042105a500d9d9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Knight
                          Filesize

                          11KB

                          MD5

                          75d442f074ab3ea857779e6a97f1a230

                          SHA1

                          4d614662fefaabe0c63c673b81aa10fdffe11130

                          SHA256

                          61cfd32c8c21ba01c8788e85f96b777beb84f7a111f32cf9cb9e2ebeef39e34d

                          SHA512

                          72e1dcb1d405952aa97a3a250ed50b3d5052beab234d71019bbfeca9fb0783cd6197313a6672b70757678391fdc364d0a9a83daa0a2117832994f4c86e9f7702

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Lose
                          Filesize

                          872KB

                          MD5

                          aaa9630d8d79b3e4145f73cc6c5d91eb

                          SHA1

                          78d39afc0b90b92f8cebfeee3f410c0547bfc0b6

                          SHA256

                          66b99fdc10bc9cdc905e7e4a76f8c747aa439d7c8deaba8f31f2476a30c57f70

                          SHA512

                          50f865aeffbc338c772034e171ca72ef20ec9fefe154a3883352823dccc18df0ec0a16bc1177c03ea15ae0ffd0413e9093ed5e0b8d8ca525c532dd6c32609247

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Lose
                          Filesize

                          313KB

                          MD5

                          d0fda828fc29cc5ea329c5f5af45ad9f

                          SHA1

                          c831e8b9ca12142da7aab205a5dd0e72fac499ad

                          SHA256

                          75561bb5daa42e869709749280e467803d9bb5f088cf13cd2b6c382c773af26b

                          SHA512

                          86ddfa0f7aab59484e2545df72332c6055afb4b4bc963761d90c81ccb8ddd6ea2c1578efab45b6a54ff0f643d34b5fb92bbddbf3807dd1bfdd2b04a12f0877f7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Methods
                          Filesize

                          94KB

                          MD5

                          de7e87e6475862919bd7b0a684f3c7e9

                          SHA1

                          26950c42ddfd72288cfb60040bcfe3360edcad20

                          SHA256

                          c494f967437b6392c5a6a03351306dd1252f23935b43385f302c31f70f8f6abc

                          SHA512

                          ae2dc4547be1de3a37677247db241066f305a423fc698937a1e9b6993c07619c56a81c83abdbaf2b8b42044c12515361c7fe43970bccc5c0b3ba28026896a216

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Select
                          Filesize

                          449B

                          MD5

                          9a8aba730b113e3d91d21a9de3bb0f4e

                          SHA1

                          b631379d9f689646cdc2c743179151dfc6556f7e

                          SHA256

                          f984acc46910e887927f3c97f5557409493849b803a23b32aa292e79596469fd

                          SHA512

                          c80334cb31d08a6ce097442e3b3108dc831e63479a561c03a469e21cf87cf824108b1aa0128ca72309cde09bf9404ee1f6ac331ed82a5220dcd311942ce319f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Started
                          Filesize

                          72KB

                          MD5

                          4318f454e38bfbff18bd966f8fa723e2

                          SHA1

                          b7ec4e2ec3a233b33cb66cd22322e5a89dadb012

                          SHA256

                          0be726ca8c6d9aafd6b04ac6ace2d924d7844c33e73b9c74e2a8b8b7daeb158d

                          SHA512

                          84a5c224246d7fcb66de131c04ef68a49cbb58412f71391c42ea055a7db6e1dcfbdb6b9b7bb827e074d1af8a1598aa81cdae95ebbf90dcd1ac32a978ced64dbb

                          Download Submit

                        • C:\Users\Admin\Desktop\S0laraG\SolaraV3.exe
                          Filesize

                          1.5MB

                          MD5

                          60742d56ad06f62f3474674a2c88459a

                          SHA1

                          a991c2f571834dab72ad67de25edc5d28837cfe7

                          SHA256

                          1f012d9ed24338e0656971ab05265dc28c476d9e2d290d3356a858ef6fadca2b

                          SHA512

                          e391e17f10ae3572547304e5c149af8c85d1106556d361001672b59b045b3abd0e7728b715fa3cc83da727660b80a1723ee36c4c594e8a7bfec941d6b6635c98

                          Download Submit

                        • C:\Users\Admin\Desktop\S0laraG\locales\resources\app.asar.unpacked\node_modules\btime\binding.node
                          Filesize

                          118KB

                          MD5

                          13a2579ed95366185a6247c9e4b9f0cc

                          SHA1

                          61fef12da622484e44b3c9ddcd61706c9af00aa0

                          SHA256

                          98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f

                          SHA512

                          7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0

                          Download Submit

                        • C:\Users\Admin\Desktop\S0laraG\locales\sl.pak
                          Filesize

                          369KB

                          MD5

                          234e628a62f822bd7b3546b91e79cab2

                          SHA1

                          10f48382495bdbfa3b30c15b91768817df13d828

                          SHA256

                          d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99

                          SHA512

                          51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456

                          Download Submit

                        • memory/1060-355-0x0000000000900000-0x0000000000988000-memory.dmp

                          Filesize

                          544KB

                          Download

                        • memory/1528-349-0x0000000004F90000-0x0000000004F9A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/1528-359-0x0000000007CF0000-0x0000000007D0E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/1528-351-0x0000000008030000-0x0000000008042000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/1528-352-0x0000000008160000-0x000000000826A000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/1528-353-0x0000000008090000-0x00000000080CC000-memory.dmp

                          Filesize

                          240KB

                          Download

                        • memory/1528-354-0x00000000080D0000-0x000000000811C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/1528-348-0x0000000004EC0000-0x0000000004F52000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/1528-357-0x0000000006230000-0x0000000006296000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/1528-358-0x0000000008E60000-0x0000000008ED6000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/1528-350-0x00000000085C0000-0x0000000008BD8000-memory.dmp

                          Filesize

                          6.1MB

                          Download

                        • memory/1528-360-0x0000000009310000-0x00000000094D2000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1528-361-0x0000000009B10000-0x000000000A03C000-memory.dmp

                          Filesize

                          5.2MB

                          Download

                        • memory/1528-347-0x00000000055A0000-0x0000000005B44000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/1528-345-0x0000000000800000-0x0000000000888000-memory.dmp

                          Filesize

                          544KB

                          Download

                        • memory/4396-423-0x0000000001100000-0x0000000001188000-memory.dmp

                          Filesize

                          544KB

                          Download

                        • memory/4516-422-0x0000000000D30000-0x0000000000DB8000-memory.dmp

                          Filesize

                          544KB

                          Download

                        • memory/4516-424-0x0000000008170000-0x00000000081BC000-memory.dmp

                          Filesize

                          304KB

                          Download