Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://github.com/Berusol/Solara-V3/releases/tag/Setup

Overview

General Information

Sample URL:https://github.com/Berusol/Solara-V3/releases/tag/Setup
Analysis ID:1603319
Infos:

Detection

PureLog Stealer
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Suricata IDS alerts for network traffic
Yara detected PureLog Stealer
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTML page contains hidden javascript code
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1920,i,3633598474005371594,11083817926262543864,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • chrome.exe (PID: 2116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/Berusol/Solara-V3/releases/tag/Setup" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • OpenWith.exe (PID: 7732 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)
  • rundll32.exe (PID: 7896 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • 7zG.exe (PID: 8056 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Downloads\Solara\" -spe -an -ai#7zMap25663:76:7zEvent3070 MD5: 50F289DF0C19484E970849AAC4E6F977)
  • Solara V3.exe (PID: 3392 cmdline: "C:\Users\user\Downloads\Solara\V3\Solara V3.exe" MD5: 8E1866938CD9BF90DD65B2C27D67378B)
    • Solara V3.exe (PID: 1456 cmdline: "C:\Users\user\Downloads\Solara\V3\Solara V3.exe" MD5: 8E1866938CD9BF90DD65B2C27D67378B)
    • Solara V3.exe (PID: 1256 cmdline: "C:\Users\user\Downloads\Solara\V3\Solara V3.exe" MD5: 8E1866938CD9BF90DD65B2C27D67378B)
    • WerFault.exe (PID: 4284 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup
SourceRuleDescriptionAuthorStrings
C:\Users\user\Downloads\Solara\V3\Solara V3.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
    C:\Users\user\Downloads\Solara\V3\Solara V3.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
      C:\Users\user\Downloads\Solara\V3\Solara V3.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        SourceRuleDescriptionAuthorStrings
        00000016.00000000.1564489736.00000000000F8000.00000002.00000001.01000000.00000009.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          00000011.00000003.1486394855.000001A04D200000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            00000016.00000002.1609312530.00000000035F9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
              No Sigma rule has matched
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-30T20:44:27.585645+010020283713Unknown Traffic192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:27.585645+010020283713Unknown Traffic192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:27.585645+010020283713Unknown Traffic192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020283713Unknown Traffic192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020283713Unknown Traffic192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020283713Unknown Traffic192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020283713Unknown Traffic192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020283713Unknown Traffic192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020283713Unknown Traffic192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020283713Unknown Traffic192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020283713Unknown Traffic192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020283713Unknown Traffic192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020283713Unknown Traffic192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020283713Unknown Traffic192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020283713Unknown Traffic192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020283713Unknown Traffic192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020283713Unknown Traffic192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020283713Unknown Traffic192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020283713Unknown Traffic192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020283713Unknown Traffic192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020283713Unknown Traffic192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020283713Unknown Traffic192.168.2.1749901104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020283713Unknown Traffic192.168.2.1749901104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020283713Unknown Traffic192.168.2.1749901104.21.31.177443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-30T20:44:27.585645+010020597681Domain Observed Used for C2 Detected192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:27.585645+010020597681Domain Observed Used for C2 Detected192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:27.585645+010020597681Domain Observed Used for C2 Detected192.168.2.1749892104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020597681Domain Observed Used for C2 Detected192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020597681Domain Observed Used for C2 Detected192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:28.662661+010020597681Domain Observed Used for C2 Detected192.168.2.1749893104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020597681Domain Observed Used for C2 Detected192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020597681Domain Observed Used for C2 Detected192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:30.309994+010020597681Domain Observed Used for C2 Detected192.168.2.1749895104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020597681Domain Observed Used for C2 Detected192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020597681Domain Observed Used for C2 Detected192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:32.935282+010020597681Domain Observed Used for C2 Detected192.168.2.1749897104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020597681Domain Observed Used for C2 Detected192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020597681Domain Observed Used for C2 Detected192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:34.122604+010020597681Domain Observed Used for C2 Detected192.168.2.1749898104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020597681Domain Observed Used for C2 Detected192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020597681Domain Observed Used for C2 Detected192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:35.422157+010020597681Domain Observed Used for C2 Detected192.168.2.1749899104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020597681Domain Observed Used for C2 Detected192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020597681Domain Observed Used for C2 Detected192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:39.524682+010020597681Domain Observed Used for C2 Detected192.168.2.1749900104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020597681Domain Observed Used for C2 Detected192.168.2.1749901104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020597681Domain Observed Used for C2 Detected192.168.2.1749901104.21.31.177443TCP
              2025-01-30T20:44:41.495848+010020597681Domain Observed Used for C2 Detected192.168.2.1749901104.21.31.177443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-30T20:44:27.096120+010020597671Domain Observed Used for C2 Detected192.168.2.17579121.1.1.153UDP
              2025-01-30T20:44:27.096120+010020597671Domain Observed Used for C2 Detected192.168.2.17579121.1.1.153UDP
              2025-01-30T20:44:27.096120+010020597671Domain Observed Used for C2 Detected192.168.2.17579121.1.1.153UDP

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeJoe Sandbox ML: detected
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeJoe Sandbox ML: detected
              Source: https://github.com/Berusol/Solara-V3/releases/tag/SetupHTTP Parser: Base64 decoded: {"referrer":"","request_id":"F17D:2B3C52:866853:8A4D7B:679BD677","visitor_id":"790885050674304631","region_edge":"fra","region_render":"fra"}
              Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49734 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49892 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49893 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49895 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49896 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49897 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49898 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49899 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49900 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49901 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 20.190.160.131:443 -> 192.168.2.17:49904 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49905 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 2.21.65.157:443 -> 192.168.2.17:49906 version: TLS 1.2
              Source: chrome.exeMemory has grown: Private usage: 1MB later: 26MB

              Networking

              barindex
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49897 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49897 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49895 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49898 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49898 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49901 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49901 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49893 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49899 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49899 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49900 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49900 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49895 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (innerkomen .com) : 192.168.2.17:57912 -> 1.1.1.1:53
              Source: Network trafficSuricata IDS: 2059767 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (innerkomen .com) : 192.168.2.17:57912 -> 1.1.1.1:53
              Source: Network trafficSuricata IDS: 2059657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49892 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49892 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2059768 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (innerkomen .com in TLS SNI) : 192.168.2.17:49893 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49897 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49898 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49901 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49899 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49900 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49895 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49892 -> 104.21.31.177:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49893 -> 104.21.31.177:443
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
              Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
              Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
              Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficDNS traffic detected: DNS query: github.com
              Source: global trafficDNS traffic detected: DNS query: github.githubassets.com
              Source: global trafficDNS traffic detected: DNS query: avatars.githubusercontent.com
              Source: global trafficDNS traffic detected: DNS query: github-cloud.s3.amazonaws.com
              Source: global trafficDNS traffic detected: DNS query: user-images.githubusercontent.com
              Source: global trafficDNS traffic detected: DNS query: www.google.com
              Source: global trafficDNS traffic detected: DNS query: collector.github.com
              Source: global trafficDNS traffic detected: DNS query: api.github.com
              Source: global trafficDNS traffic detected: DNS query: objects.githubusercontent.com
              Source: global trafficDNS traffic detected: DNS query: innerkomen.com
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
              Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
              Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
              Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
              Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
              Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
              Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
              Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
              Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
              Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
              Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
              Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
              Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
              Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
              Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
              Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
              Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
              Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
              Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
              Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
              Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
              Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
              Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
              Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
              Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
              Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
              Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
              Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
              Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
              Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
              Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49905 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49891 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49890 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
              Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
              Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
              Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
              Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
              Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
              Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
              Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49877 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49899 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49907
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49906
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49905
              Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49904
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49903
              Source: unknownNetwork traffic detected: HTTP traffic on port 49903 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49900
              Source: unknownNetwork traffic detected: HTTP traffic on port 49888 -> 443
              Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49734 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49892 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49893 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49895 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49896 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49897 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49898 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49899 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49900 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.31.177:443 -> 192.168.2.17:49901 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 20.190.160.131:443 -> 192.168.2.17:49904 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49905 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 2.21.65.157:443 -> 192.168.2.17:49906 version: TLS 1.2
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 968
              Source: classification engineClassification label: mal92.troj.spyw.evad.win@26/99@27/232
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMutant created: NULL
              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3392
              Source: C:\Windows\System32\OpenWith.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
              Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\4f2074a7-a1c3-443b-90ae-5e82057440b9
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSystem information queried: HandleInformation
              Source: C:\Windows\System32\OpenWith.exeFile read: C:\Users\desktop.ini
              Source: C:\Windows\System32\OpenWith.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
              Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1920,i,3633598474005371594,11083817926262543864,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/Berusol/Solara-V3/releases/tag/Setup"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1920,i,3633598474005371594,11083817926262543864,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: unknownProcess created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
              Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: unknownProcess created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Downloads\Solara\" -spe -an -ai#7zMap25663:76:7zEvent3070
              Source: unknownProcess created: C:\Users\user\Downloads\Solara\V3\Solara V3.exe "C:\Users\user\Downloads\Solara\V3\Solara V3.exe"
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Users\user\Downloads\Solara\V3\Solara V3.exe "C:\Users\user\Downloads\Solara\V3\Solara V3.exe"
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Users\user\Downloads\Solara\V3\Solara V3.exe "C:\Users\user\Downloads\Solara\V3\Solara V3.exe"
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 968
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Users\user\Downloads\Solara\V3\Solara V3.exe "C:\Users\user\Downloads\Solara\V3\Solara V3.exe"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Windows\System32\OpenWith.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: twinui.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: wintypes.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: powrprof.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: dwmapi.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: pdh.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: umpdc.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: actxprxy.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.staterepositoryps.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.ui.appdefaults.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.ui.immersive.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: ntmarta.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: uiautomationcore.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: dui70.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: duser.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: dwrite.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: bcp47mrm.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: uianimation.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d11.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: dxgi.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: resourcepolicyclient.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: oleacc.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: edputil.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.ui.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windowmanagementapi.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: textinputframework.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: inputhost.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: twinapi.appcore.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: twinapi.appcore.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coreuicomponents.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coreuicomponents.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windowscodecs.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: thumbcache.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: apphelp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: appresolver.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: bcp47langs.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: slc.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: sppc.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: tiledatarepository.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: staterepository.core.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.staterepository.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: wtsapi32.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: windows.staterepositorycore.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: mrmcorer.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: directmanipulation.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: d3d10warp.dll
              Source: C:\Windows\System32\OpenWith.exeSection loaded: textshaping.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: uxtheme.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: cryptbase.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: explorerframe.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: textshaping.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: textinputframework.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: coreuicomponents.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: coremessaging.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: ntmarta.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: coremessaging.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dll
              Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: mscoree.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: apphelp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: version.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: wldp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: wldp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: winhttp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: webio.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: mswsock.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: winnsi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: sspicli.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: schannel.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: msasn1.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: gpapi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: dpapi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: wbemcomn.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: amsi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: userenv.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: profapi.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: version.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\OpenWith.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Downloads\Solara\V3\mqutil.dllJump to dropped file
              Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Downloads\Solara\V3\Solara V3.exeJump to dropped file
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\OpenWith.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeSystem information queried: FirmwareTableInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory allocated: 7C0000 memory reserve | memory write watch
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory allocated: 25F0000 memory reserve | memory write watch
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory allocated: 2410000 memory reserve | memory write watch
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWindow / User API: threadDelayed 637
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWindow / User API: threadDelayed 1363
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWindow / User API: threadDelayed 4294
              Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Downloads\Solara\V3\mqutil.dllJump to dropped file
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 6088Thread sleep time: -90000s >= -30000s
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 7396Thread sleep time: -30000s >= -30000s
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 7392Thread sleep time: -30000s >= -30000s
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 2120Thread sleep count: 637 > 30
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 2120Thread sleep count: 1363 > 30
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe TID: 2120Thread sleep count: 4294 > 30
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess information queried: ProcessInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess queried: DebugPort
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess queried: DebugPort
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory allocated: page read and write | page guard

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory allocated: C:\Users\user\Downloads\Solara\V3\Solara V3.exe base: 600000 protect: page read and write
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory written: C:\Users\user\Downloads\Solara\V3\Solara V3.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory written: C:\Users\user\Downloads\Solara\V3\Solara V3.exe base: 600000
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory written: C:\Users\user\Downloads\Solara\V3\Solara V3.exe base: 5E62D8
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeMemory written: C:\Users\user\Downloads\Solara\V3\Solara V3.exe base: 5E71E8
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeProcess created: C:\Users\user\Downloads\Solara\V3\Solara V3.exe "C:\Users\user\Downloads\Solara\V3\Solara V3.exe"
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
              Source: C:\Windows\System32\OpenWith.exeQueries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeQueries volume information: C:\Users\user\Downloads\Solara\V3\Solara V3.exe VolumeInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

              Stealing of Sensitive Information

              barindex
              Source: Yara matchFile source: 00000016.00000000.1564489736.00000000000F8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1486394855.000001A04D200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe, type: DROPPED
              Source: Yara matchFile source: 00000016.00000002.1609312530.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\formhistory.sqlite
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\logins.json
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\prefs.js
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cert9.db
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\key4.db
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\places.sqlite
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\FTPRush
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\FTPInfo
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\FTPbox
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\ProgramData\SiteDesigner\3D-FTP
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\FTPGetter
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Binance
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
              Source: C:\Users\user\Downloads\Solara\V3\Solara V3.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

              Remote Access Functionality

              barindex
              Source: Yara matchFile source: 00000016.00000000.1564489736.00000000000F8000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1486394855.000001A04D200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: C:\Users\user\Downloads\Solara\V3\Solara V3.exe, type: DROPPED
              Source: Yara matchFile source: 00000016.00000002.1609312530.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
              Windows Management Instrumentation
              1
              Registry Run Keys / Startup Folder
              311
              Process Injection
              1
              Masquerading
              2
              OS Credential Dumping
              22
              Security Software Discovery
              Remote Services3
              Data from Local System
              2
              Encrypted Channel
              Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/Job1
              DLL Side-Loading
              1
              Registry Run Keys / Startup Folder
              23
              Virtualization/Sandbox Evasion
              LSASS Memory23
              Virtualization/Sandbox Evasion
              Remote Desktop ProtocolData from Removable Media1
              Non-Application Layer Protocol
              Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
              DLL Side-Loading
              1
              Disable or Modify Tools
              Security Account Manager2
              Process Discovery
              SMB/Windows Admin SharesData from Network Shared Drive2
              Application Layer Protocol
              Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
              Extra Window Memory Injection
              311
              Process Injection
              NTDS1
              Application Window Discovery
              Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Rundll32
              LSA Secrets1
              File and Directory Discovery
              SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              DLL Side-Loading
              Cached Domain Credentials23
              System Information Discovery
              VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Extra Window Memory Injection
              DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.