Analysis
-
max time kernel
1797s -
max time network
1717s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 15:13
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win7-20231129-en
General
-
Target
SolaraBootstrapper.exe
-
Size
798KB
-
MD5
baa81d6b98890ac06befe560d00be992
-
SHA1
b69769c15af3ff85ca16a4ee579ea7fd959179e9
-
SHA256
ec710ba066a78e3faf19b9d9a589ace5540a6a31551dc977b533e7d67352f87b
-
SHA512
ded06cff210a201a53670ab55078c4edfcc0c4137af04b1ad3966b69464ec717957508b341d5f5fef485679bdd841017c420a14217d9480181a03fcd9aaad7f1
-
SSDEEP
12288:PZZmz3HwnXFZ9RgoOojAojAbJaTGLLvlguxD:3mz3Hi9tOojAojAbdLL
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cd57e4c171d6e8f5ea8b8f824a6a7316.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SolaraBootstrapper.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation SolaraBootstrapper.exe -
Executes dropped EXE 3 IoCs
Processes:
vc_redist.x64.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exepid process 1400 vc_redist.x64.exe 740 vc_redist.x64.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Loads dropped DLL 17 IoCs
Processes:
MsiExec.exeMsiExec.exeMsiExec.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exepid process 3524 MsiExec.exe 3524 MsiExec.exe 668 MsiExec.exe 668 MsiExec.exe 668 MsiExec.exe 668 MsiExec.exe 668 MsiExec.exe 3168 MsiExec.exe 3168 MsiExec.exe 3168 MsiExec.exe 3524 MsiExec.exe 740 vc_redist.x64.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll themida behavioral2/memory/4832-4018-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4020-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4021-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4022-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4227-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4259-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4263-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4268-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4272-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4303-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4315-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4346-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4400-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4413-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4427-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4637-0x0000000180000000-0x0000000180AC0000-memory.dmp themida behavioral2/memory/4832-4652-0x0000000180000000-0x0000000180AC0000-memory.dmp themida -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid process 23 2964 msiexec.exe 24 2964 msiexec.exe 26 2964 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
Processes:
flow ioc 49 raw.githubusercontent.com 149 raw.githubusercontent.com 160 raw.githubusercontent.com 48 raw.githubusercontent.com 63 raw.githubusercontent.com 159 raw.githubusercontent.com 62 raw.githubusercontent.com 155 raw.githubusercontent.com 165 raw.githubusercontent.com 169 raw.githubusercontent.com 92 raw.githubusercontent.com 93 raw.githubusercontent.com 99 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exepid process 4832 cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exemsedgewebview2.exedescription ioc process File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ssri\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_common.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\nesting.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-pack.1 msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1006041906\hyph-hi.hyb msedgewebview2.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\config.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\reify-finish.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\unique-filename\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\edit.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wcwidth\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\reify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\wide-truncate.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\explore.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\socks\build\common\helpers.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\LICENSE.md msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1446020047\Sigma\Content msedgewebview2.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\rm\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\browser.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\ours\errors.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-uninstall.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\auth.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\base.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\write-file-atomic\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-uninstall.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\inc.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\node_modules\minimatch\lib\path.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\CONTRIBUTING.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\root.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\unique-filename\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\index.cjs msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\spin.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\bin\cssesc msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\lib\opts-arg.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\socks\typings\common\util.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\listeners.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\lib\version.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\store\map.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man7\orgs.7 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\strip-trailing-slashes.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-support\browser.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\min-version.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\diff\css.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\ll.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\state.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\bin\npx msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\clean-url.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\get.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\src\layout-manager.js msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1436047923\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe -
Drops file in Windows directory 21 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI6AC9.tmp msiexec.exe File opened for modification C:\Windows\Installer\e573ebe.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4249.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4EE1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4962.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6A4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI6CCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI701A.tmp msiexec.exe File created C:\Windows\Installer\e573ebe.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4932.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F02.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSI470E.tmp msiexec.exe File created C:\Windows\Installer\e573ec2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI42A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42D7.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exemsedgewebview2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
msiexec.exemsedgewebview2.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629454350804899" msedgewebview2.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe -
Modifies registry class 30 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media msiexec.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 487082.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedgewebview2.exepid process 3984 SolaraBootstrapper.exe 3984 SolaraBootstrapper.exe 2964 msiexec.exe 2964 msiexec.exe 3908 msedge.exe 3908 msedge.exe 3384 msedge.exe 3384 msedge.exe 924 identity_helper.exe 924 identity_helper.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe 3572 msedgewebview2.exe 3572 msedgewebview2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exemsedgewebview2.exepid process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 5496 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exemsiexec.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 3984 SolaraBootstrapper.exe Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2964 msiexec.exe Token: SeCreateTokenPrivilege 2268 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2268 msiexec.exe Token: SeLockMemoryPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeMachineAccountPrivilege 2268 msiexec.exe Token: SeTcbPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeLoadDriverPrivilege 2268 msiexec.exe Token: SeSystemProfilePrivilege 2268 msiexec.exe Token: SeSystemtimePrivilege 2268 msiexec.exe Token: SeProfSingleProcessPrivilege 2268 msiexec.exe Token: SeIncBasePriorityPrivilege 2268 msiexec.exe Token: SeCreatePagefilePrivilege 2268 msiexec.exe Token: SeCreatePermanentPrivilege 2268 msiexec.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeDebugPrivilege 2268 msiexec.exe Token: SeAuditPrivilege 2268 msiexec.exe Token: SeSystemEnvironmentPrivilege 2268 msiexec.exe Token: SeChangeNotifyPrivilege 2268 msiexec.exe Token: SeRemoteShutdownPrivilege 2268 msiexec.exe Token: SeUndockPrivilege 2268 msiexec.exe Token: SeSyncAgentPrivilege 2268 msiexec.exe Token: SeEnableDelegationPrivilege 2268 msiexec.exe Token: SeManageVolumePrivilege 2268 msiexec.exe Token: SeImpersonatePrivilege 2268 msiexec.exe Token: SeCreateGlobalPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeSecurityPrivilege 4404 wevtutil.exe Token: SeBackupPrivilege 4404 wevtutil.exe Token: SeSecurityPrivilege 4668 wevtutil.exe Token: SeBackupPrivilege 4668 wevtutil.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe Token: SeTakeOwnershipPrivilege 2964 msiexec.exe Token: SeRestorePrivilege 2964 msiexec.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
msedge.exepid process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exeMsiExec.exewevtutil.exevc_redist.x64.exemsedge.exedescription pid process target process PID 3984 wrote to memory of 2268 3984 SolaraBootstrapper.exe msiexec.exe PID 3984 wrote to memory of 2268 3984 SolaraBootstrapper.exe msiexec.exe PID 3984 wrote to memory of 2268 3984 SolaraBootstrapper.exe msiexec.exe PID 2964 wrote to memory of 3524 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 3524 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 668 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 668 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 668 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 3168 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 3168 2964 msiexec.exe MsiExec.exe PID 2964 wrote to memory of 3168 2964 msiexec.exe MsiExec.exe PID 3168 wrote to memory of 4404 3168 MsiExec.exe wevtutil.exe PID 3168 wrote to memory of 4404 3168 MsiExec.exe wevtutil.exe PID 3168 wrote to memory of 4404 3168 MsiExec.exe wevtutil.exe PID 4404 wrote to memory of 4668 4404 wevtutil.exe wevtutil.exe PID 4404 wrote to memory of 4668 4404 wevtutil.exe wevtutil.exe PID 3984 wrote to memory of 1400 3984 SolaraBootstrapper.exe vc_redist.x64.exe PID 3984 wrote to memory of 1400 3984 SolaraBootstrapper.exe vc_redist.x64.exe PID 3984 wrote to memory of 1400 3984 SolaraBootstrapper.exe vc_redist.x64.exe PID 1400 wrote to memory of 740 1400 vc_redist.x64.exe vc_redist.x64.exe PID 1400 wrote to memory of 740 1400 vc_redist.x64.exe vc_redist.x64.exe PID 1400 wrote to memory of 740 1400 vc_redist.x64.exe vc_redist.x64.exe PID 3984 wrote to memory of 3384 3984 SolaraBootstrapper.exe msedge.exe PID 3984 wrote to memory of 3384 3984 SolaraBootstrapper.exe msedge.exe PID 3384 wrote to memory of 4636 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 4636 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe PID 3384 wrote to memory of 2152 3384 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\msiexec.exe"msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\Temp\{A8B35493-9ECD-476F-B6A8-19AC51847589}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{A8B35493-9ECD-476F-B6A8-19AC51847589}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pizzaboxer/bloxstrap/releases/download/v2.5.4/Bloxstrap-v2.5.4.exe2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe702846f8,0x7ffe70284708,0x7ffe702847183⤵PID:4636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:23⤵PID:2152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:83⤵PID:1940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:13⤵PID:4284
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:13⤵PID:4356
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:83⤵PID:4228
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:13⤵PID:4048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵PID:740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4016 /prefetch:83⤵PID:3368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:13⤵PID:2664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:83⤵PID:4364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:13⤵PID:824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:13⤵PID:3204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10312499638790310756,2947953835830092168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4832 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4832.5432.148198644153041882553⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5496 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x160,0x164,0x168,0x15c,0x138,0x7ffe6c954ef8,0x7ffe6c954f04,0x7ffe6c954f104⤵PID:5552
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:24⤵PID:5804
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2016,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:34⤵PID:5836
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2300,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:84⤵PID:5952
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3596,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵PID:2080
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2228,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:84⤵PID:628
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4080,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:84⤵PID:1640
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2104,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4764,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:84⤵PID:1420
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4184,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:84⤵PID:3840
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4156,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:84⤵PID:3320
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2232,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:84⤵PID:1480
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=752,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:84⤵PID:1516
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4436,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:84⤵PID:5444
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4696,i,6666176866057788555,7534271505209743362,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:84⤵PID:2816
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D4EAEB59ABE2F82BED57AD491F3D519D2⤵
- Loads dropped DLL
PID:3524 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CA88530173CF3FB81C21F70804160DF52⤵
- Loads dropped DLL
PID:668 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0FD3D3BC0E6D9234D6F72D64EB3C9E5A E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e573ec1.rbsFilesize
1.0MB
MD54652d2b325fab775d812ce28dd331273
SHA1bee5ac45a47ae2686d4509efbe10e0320291e0c5
SHA25649ffadda87311aedadbf4996f20eb1d754b9f1098a1123c8d6114a05fc340204
SHA512538c54fd01733d703f36ded0dfe0cc69439c2cff7c461fd9a1147b4c119ae54b987fe84521a04967ecc02d7e2396f1db27bb2b4f71bb1afbe67d03cfc11256f3
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1006041906\hyph-as.hybFilesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1006041906\hyph-hi.hybFilesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1006041906\hyph-nb.hybFilesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1006041906\manifest.jsonFilesize
179B
MD5273755bb7d5cc315c91f47cab6d88db9
SHA1c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA2560e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
SHA5120e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1148811374\manifest.jsonFilesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1258492134\manifest.jsonFilesize
102B
MD58062e1b9705b274fd46fcd2dd53efc81
SHA161912082d21780e22403555a43408c9a6cafc59a
SHA2562f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35
SHA51298609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1436047923\manifest.jsonFilesize
76B
MD5ba25fcf816a017558d3434583e9746b8
SHA1be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA2560d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA5123763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1446020047\manifest.jsonFilesize
132B
MD5e2e0e30a5061d2e813d389d776cd8ffd
SHA190913c06260b62534b42c0e28bac3082cdacd19c
SHA2567f8c92b4e9da2afa5a089e37797036d18e61e4f02a4885b7887c0b98d464259f
SHA512000727f5052c846e39c62ae90032db500708e5fec5af24b8cc1f3a9d4102bc7b9be025176f01722a7c72b5e8bf85b0084cab0ebeb00fde03928c4e22869c98cd
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1608757518\manifest.fingerprintFilesize
66B
MD50c9218609241dbaa26eba66d5aaf08ab
SHA131f1437c07241e5f075268212c11a566ceb514ec
SHA25652493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b
SHA5125d25a1fb8d9e902647673975f13d7ca11e1f00f3c19449973d6b466d333198768e777b8cae5becef5c66c9a0c0ef320a65116b5070c66e3b9844461bb0ffa47f
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1608757518\manifest.jsonFilesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_1788620475\manifest.jsonFilesize
79B
MD59f334804d984c140e3eb9644171ce6de
SHA13f24cca85f25517e9ee9cc6bfcee4f10169f5376
SHA2564fe9e95540546ad31adbe93bc4780aeb381acc9c769422a8f8aec9a1a5376c79
SHA512dec0efd18a63abf3368ccd0122d4d461b68c92c20961416c22f28c5b9d85d8f06779436b1b992e315fe649557f65e51512a74e7642a5a5dcbba9a69c6317ef8d
-
C:\Program Files\chrome_Unpacker_BeginUnzipping5496_627649428\manifest.jsonFilesize
116B
MD5178174a0125d4ff3ed5211426f1ea113
SHA126f72c5a2f65c767c4edb04d8da62bdadc02e809
SHA25664986dfeefa8855069e799b28e5523b35c9efcf2ea152a2b03461471c218da1f
SHA512c0d1d9555f4cd7e9a4b0ee5fc1b069782638ba1680d18ba9c83f796746086b6afdf1400c80b7f586422c3a2a73e51bd04fb250e2db818ef723cb4f7a8b3b15a2
-
C:\Program Files\nodejs\node_etw_provider.manFilesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
C:\Program Files\nodejs\node_etw_provider.manFilesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.mdFilesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\licenseFilesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSEFilesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.mdFilesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSEFilesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.jsonFilesize
1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSEFilesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.jsFilesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSEFilesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSEFilesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.tsFilesize
4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSEFilesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.urlFilesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
265B
MD5ee77ee0ddce6df6a4cf39b6d19ea6b4c
SHA1d5407a3c365266b7a794e647bc17ed9e06b4389f
SHA25679a078c39145a1dc1c27c15f05bb7a39bdaf7aec14fd85a2dcfd36b95a3f5b36
SHA5121841689b05aab9ba73ac48bb390c148e92d218b07da6b89bbec900bcb84055fe2080115545933d495f6e8f2506497af930fbab1c68cf65ff080f2d5a61b30eeb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD540b5e315b3e982ca2fde6e6150d6d013
SHA128367cbdd341b234052fd7a289b430e4205c7de1
SHA25649815d1be86c1c5351a70e5ce34958537a1544415e9459ee3bea604ff1ee2fce
SHA512780f64a6fa4ff167409465041a92445532891ba59935f1753d1215e52663cb61f4743059d54555d1617d1ae83c557d3184674e147e0f58130dfd66ae84915368
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD518d746cfb9cdb599fb97a24ca6aa8b27
SHA119efcc833ffb23e1f24b961092c363057aa58407
SHA2560bb428283461f36f4c124da0317e4aa36ccd54126ce961c826d362ea2512f03a
SHA512609ff178c7ff0c7ca0f36e2b1addc1604115446fcbf592eb53c42cf5d2d4664dfc595dd1063962610ef11c11ae620d961cd1d0fdf1e62bc29728232a9c32c939
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD50e4207d7a76bab99efb5957cd89ec350
SHA1bdfcd0c8311332720bb8f2146d087eceb573b802
SHA256a520da8c161ad84011ff1e14a2bcce20b941bf7e54e281ab89f96f2e43207a43
SHA5124a6e25993aae421451320480b049724b48af029a463162dfa284d04c966e6ab7fa8249b80edbb73ff6932b6897f15b47b18ea247378b71e47e676f9424aabfe0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dllFilesize
488KB
MD5851fee9a41856b588847cf8272645f58
SHA1ee185a1ff257c86eb19d30a191bf0695d5ac72a1
SHA2565e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
SHA512cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dllFilesize
37KB
MD54cf94ffa50fd9bdc0bb93cceaede0629
SHA13e30eca720f4c2a708ec53fd7f1ba9e778b4f95f
SHA25650b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6
SHA512dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dllFilesize
43KB
MD534ec990ed346ec6a4f14841b12280c20
SHA16587164274a1ae7f47bdb9d71d066b83241576f0
SHA2561e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
SHA512b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrcFilesize
139B
MD5d0104f79f0b4f03bbcd3b287fa04cf8c
SHA154f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA256997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
SHA512daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrcFilesize
43B
MD5c28b0fe9be6e306cc2ad30fe00e3db10
SHA1af79c81bd61c9a937fca18425dd84cdf8317c8b9
SHA2560694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
SHA512e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrcFilesize
216B
MD5c2ab942102236f987048d0d84d73d960
SHA195462172699187ac02eaec6074024b26e6d71cff
SHA256948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
SHA512e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSEFilesize
1KB
MD513babc4f212ce635d68da544339c962b
SHA14881ad2ec8eb2470a7049421047c6d076f48f1de
SHA256bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400
SHA51240e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dllFilesize
133KB
MD5a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1dd109ac34beb8289030e4ec0a026297b793f64a3
SHA25679d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
SHA5122a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dllFilesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\path.txtFilesize
34B
MD50e2184f1c7464b6617329fb18f107b4f
SHA16f22f98471e33c9db10d6f6f1728e98852e25b8f
SHA256dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb
SHA5128e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dllFilesize
4.1MB
MD5c2bde3ba169916206ef61ce2af29abd5
SHA19ea8cc423fdd68280988d94f2eac468e445d34f8
SHA2562099337afdfc49b325763e2e741253aac15c195e0010039a625459e8ea1ac526
SHA512442e5935be20dd345fb9940113a7db2e06649eb36fc79a4b7128e3054c8a27a34c62b826397b2d46810ea32f3b2d8367bb375b7996019fcbc2d400dff5f21ca0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exeFilesize
86KB
MD5d213a75b1956398e4c36bcc2f93339bf
SHA16a2739cc0e67f5593c744fbcbc8f00f12eef9954
SHA256ece75d080f94df4b3699389021337b1536cfed229d1325f09b03f0b0d6d85ab4
SHA512d32ddaf4c6f8f8df6c390d683e6c039f3b0d8f35f68f690b28bf88b17caedf0e11abd3aeb2e46238d0cd0a91b2db095cca0782b4e27f04453ea4cb6db38f4dd7
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.jsonFilesize
3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.datFilesize
280B
MD5f49a215a15d06e4a02a0e074a9420248
SHA1d495f65d1cf3cd1c243efc0e212e6a98ed029119
SHA256f0c716b462a859f052f467ac1619fb5183935eed372e17290d85fae3038d15ef
SHA5124c29d4c94da389c33debe683029f42b77d7b64f04c48f484b816d389494cd01f47ead5f5c968c42cc0d54f6856c80ebe1b5b751f04c6d2f80c2c11534db50336
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.datFilesize
280B
MD5936d9730d984c3af4a2397deb76a2a9c
SHA19497265f03c3998c803f12cc84d599a50ba90d33
SHA25685e8e020ed45d647d14fd345387068d18169cf29aa0608ce29b5ac56864d7f0d
SHA5124970513defe0c898ee9a9478c674ea76b7c769cf3b4f063f229f61ede6e3757eb7251f42edfc543ddaa84513e16ff324fceb9d2b96596c5bd6e6d22b1c585c9f
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.datFilesize
20B
MD59e4e94633b73f4a7680240a0ffd6cd2c
SHA1e68e02453ce22736169a56fdb59043d33668368f
SHA25641c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent StateFilesize
1KB
MD5d85ba8a192a38b7c33f335bd11c09006
SHA1a93ebed6a3e674623be898c6e82f629ef7060e82
SHA256aa76184c883943f54a172e19285c4246acbde08e80094a9331f6df10890e8728
SHA512dd745e45e0d0bc2314f8200df6d5afc8753fbfed68cafec5ab64f87f442e8701dfaf5713702c097512a2280172fd3fe0a0a077b4dc3f2a8d0daabb7489564042
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe58e059.TMPFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\PreferencesFilesize
6KB
MD524ce50cdc1f5d7a36ee34e85d3b7e3b8
SHA1189b3941a11d19c53d34a1ac25048925f1671be7
SHA2564c84834d4e35e708f3b4cd304db283bb89a9b45ad99f58b505cd9b9bacc359f2
SHA5124e9212606caf72b5175ce833f7604ef75b9e3a42520ac7a58f567e8a4a11bf735639cb62ae55483a3646e1df1f30c8f8efd70d92a7675cf25de35686f4aadf5b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\ded9204c-9df1-45da-b27a-de66058fa827.tmpFilesize
6KB
MD51b48d31c9b27fa422371697764380d70
SHA10ac202cd7f44bb46c85f65e90d8989b0d236872c
SHA256c54817c27a96908285f22db6703ff33876bb39ddb59e8bbe8568cb6ff74df11f
SHA512152b4fc0413651886ab3535c22d7f3d5e6ecc7647a5dc1f47f5e62b47c7bcf5706a61b30d58e19e634f350c530e35620ccbb68bf964c119af74358955151a206
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
2KB
MD5cf90ce45100965420fac7a82b2ee95b8
SHA1dc233c73e177d83ca5953afdae39db380b35ec64
SHA2568ce9a87089afe44f84eaf7a96c819cddd0dce87fc727f0d603ce9fd10b3f5ede
SHA512b5bb62a96a2d7b0055ef2c98a442687d4e88ab96603967fa88ddcd5d31e1d88025956eb4dfa394ce958684d0b5873638fc601e0c1b579d9d4036da56b7a1b5a2
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
3KB
MD5faea2d5cd43834be69ec4629c4456e95
SHA11df0466c5aaefebb099c3983ba3588b230cb1835
SHA2567f18083372b5df98065d6c860cac1e70f71442b66d60c4017dc4d32aa2731eeb
SHA51210b9dece0f52134d1874c86cbadfbaf56bb8ea40b8fda06c136f83e1642544fc5e37b95a390ac606c7aa58332a029f59b4caae5e43f9de9881de24fa43d24083
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
16KB
MD5085e1ddb6faac30fe4c40363750e5b42
SHA1f5536600065a90c393f4b03bd33c4bfe6175f3a4
SHA256f61a34b32598adb2a91c2c5f781223bd4d193f816d1ed780d54478d4053bea3f
SHA512f5a8da8a544164ca4b2b3a0d705695aaa96f10e81c8a5ecd30cff61805113e93bfc1dfc379532b68f19e2d9e30ccf4783e4bb35be021600417bdd5496db604a2
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
18KB
MD56bf5a5ea303d50f7713895f236c89f1c
SHA1a6c5ea1c4a41e0fa738546b391112c0980f07775
SHA2562c4ed10fe093845fcf635a7779b71567270c3dc9909dc40c48090dd3734ce45a
SHA51259e4be62a5b111c4cd21daebe8ff2a4765a08fef31c92fce49ba529555b9de46fe2960afa2a6fe086498af61210212108b840caa24217e1f46c92211f4be52ab
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe57caf1.TMPFilesize
1KB
MD50e878d974c4fd299b3ed85384fe72f4a
SHA100fb284752635027375bdaa7f79acb6d4872f416
SHA2568d30fff39e1465bfa9ec5a5cd394ffd3f16c82b323b928586884bced1e178b07
SHA5128ac020e48433ef29f8f4e952fd868dcec4f3dbaab4f328050a8b2a25cc5a2090aa71f8c56fe3e9509fdae1ca616df246ad3fe2d02c9d19703a583b8c0b36ee4e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\crs.pbFilesize
278KB
MD5981a9155cad975103b6a26acef33a866
SHA11965290a94d172c4def1ac7199736c26dccca33e
SHA256971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d
SHA5122d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pbFilesize
11KB
MD5d43d041e531dc757a69a90cb657ef437
SHA109138b427565bc276cfd3ba9f59b0c8bad78e91d
SHA2569431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb
SHA512476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\Filtering RulesFilesize
1.8MB
MD5a97ea939d1b6d363d1a41c4ab55b9ecb
SHA13669e6477eddf2521e874269769b69b042620332
SHA25697115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f
SHA512399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\LICENSEFilesize
24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\AdvertisingFilesize
24KB
MD5131857baba78228374284295fcab3d66
SHA1180e53e0f9f08745f28207d1f7b394455cf41543
SHA256b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49
SHA512c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\AnalyticsFilesize
4KB
MD5da298eacf42b8fd3bf54b5030976159b
SHA1a976f4f5e2d81f80dc0e8a10595190f35e9d324b
SHA2563abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec
SHA5125bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptionsFilesize
689B
MD5108de320dc5348d3b6af1f06a4374407
SHA190aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA2565b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
SHA51270f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\ContentFilesize
6KB
MD597ea4c3bfaadcb4b176e18f536d8b925
SHA161f2eae05bf91d437da7a46a85cbaa13d5a7c7af
SHA25672ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554
SHA5125a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CryptominingFilesize
1KB
MD516779f9f388a6dbefdcaa33c25db08f6
SHA1d0bfd4788f04251f4f2ac42be198fb717e0046ae
SHA25675ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639
SHA512abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\EntitiesFilesize
68KB
MD5571c13809cc4efaff6e0b650858b9744
SHA183e82a841f1565ad3c395cbc83cb5b0a1e83e132
SHA256ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b
SHA51293ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\FingerprintingFilesize
1KB
MD5b46196ad79c9ef6ddacc36b790350ca9
SHA13df9069231c232fe8571a4772eb832fbbe376c23
SHA256a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3
SHA51261d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\LICENSEFilesize
34KB
MD5d32239bcb673463ab874e80d47fae504
SHA18624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA2568ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA5127633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\OtherFilesize
34B
MD5cd0395742b85e2b669eaec1d5f15b65b
SHA143c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA2562b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
SHA5124df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\SocialFilesize
355B
MD54c817c4cb035841975c6738aa05742d9
SHA11d89da38b339cd9a1aadfc824ed8667018817d4e
SHA2564358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6
SHA512fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\TransparentAdvertisersFilesize
105B
MD557d5a3548911886de2f3bd3172e808ed
SHA1ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA256d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
SHA512933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\AdvertisingFilesize
2KB
MD5326ddffc1f869b14073a979c0a34d34d
SHA1df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63
SHA256d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb
SHA5123822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\AnalyticsFilesize
432B
MD501f1f3c305218510ccd9aaa42aee9850
SHA1fbf3e681409d9fb4d36cba1f865b5995de79118c
SHA25662d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620
SHA512e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\ContentFilesize
48B
MD57b0b4a9aafc18cf64f4d4daf365d2d8d
SHA1e9ed1ecbec6cccfefe00f9718c93db3d66851494
SHA2560b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43
SHA512a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\CryptominingFilesize
32B
MD54ec1eda0e8a06238ff5bf88569964d59
SHA1a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA256696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
SHA512c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\EntitiesFilesize
42KB
MD5f446eb7054a356d9e803420c8ec41256
SHA198a1606a2ba882106177307ae11ec76cfb1a07ee
SHA2564dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640
SHA5123cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\FingerprintingFilesize
172B
MD53852430540e0356d1ba68f31be011533
SHA1d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff
SHA256f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054
SHA5127a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\LICENSEFilesize
66B
MD55b7baf861a48c045d997992424b5877b
SHA12b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA25644071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
SHA5124820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\OtherFilesize
91B
MD509cedaa60eab8c7d7644d81cf792fe76
SHA1e68e199c88ea96fcb94b720f300f7098b65d1858
SHA256c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975
SHA512564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\SocialFilesize
3KB
MD5318801ce3611c0d25c65b809dd9b5b3c
SHA1b9d07f2aa9da1d83180dc24459093e20fe9cf1d8
SHA2562458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03
SHA5127daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\StagingFilesize
16KB
MD539bdf35ac4557a2d2a4efdeeb038723e
SHA19703ca8af3432b851cb5054036de32f8ba7b083f
SHA25604441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae
SHA512732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\manifest.fingerprintFilesize
66B
MD5fc8af1e27127535b4eea55c8c2285865
SHA1dc9fb2a8fe358f84f4f2749460ef15507e7ecb07
SHA256c76f988dee6149c0c21f7f657688a7fcaa20b0dc83881efe14d58d9be3f5236b
SHA512ec847bd27383c37cd67d9204e5dc55256ca0303c0d7696558de650b569ef8f9eb747603180ae6561f884bbe6eb519a23c18fa4a646c43d58799f01744c2b9de3
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2024.6.12.1\keys.jsonFilesize
6KB
MD52d4de461500a8828a8f9f788973c891b
SHA1044b9052a3e463dde9d8d8a3fdb56085fcc4c6f6
SHA25653a6e5dc368a54486f7580bdefeef06cd8c940f4e697343d774a59f679422320
SHA5124a21c8baa20d899f45a0b6e545bf3d6d07b2421c5e5ccb547a8554734b8a51457a953c67afb9897a0baaf3e6d3c69d05e9f698b590b0f522d1a6d8e6109c2011
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\a68a932b-f068-4b2b-b825-50d22de9f2a6.tmpFilesize
1KB
MD5dc86cb04c438db0ef3b90169d365ebe6
SHA119a2c66160c2b60d7743419fde053af91797f305
SHA256c64a2cdbc73a519befd305625777c33222ebec429c2728dcb5ddc7716f2f1b82
SHA5129861f412b93ac692384dd8850a3047ab02e92037726bbee2ebe67e473f7b4bbfc13578c6e8d18f2bd9fd6151d9f37ed377e02efb59bf20d70d6c46cbd390abcf
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\libcurl.dllFilesize
522KB
MD5e31f5136d91bad0fcbce053aac798a30
SHA1ee785d2546aec4803bcae08cdebfd5d168c42337
SHA256ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671
SHA512a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\vcruntime140.dllFilesize
99KB
MD57a2b8cfcd543f6e4ebca43162b67d610
SHA1c1c45a326249bf0ccd2be2fbd412f1a62fb67024
SHA2567d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
SHA512e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\zlib1.dllFilesize
113KB
MD575365924730b0b2c1a6ee9028ef07685
SHA1a10687c37deb2ce5422140b541a64ac15534250f
SHA256945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b
SHA512c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1
-
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msiFilesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exeFilesize
24.1MB
MD5e091e9e5ede4161b45b880ccd6e140b0
SHA11a18b960482c2a242df0e891de9e3a125e439122
SHA256cee28f29f904524b7f645bcec3dfdfe38f8269b001144cd909f5d9232890d33b
SHA512fa8627055bbeb641f634b56059e7b5173e7c64faaa663e050c20d01d708a64877e71cd0b974282c70cb448e877313b1cf0519cf6128c733129b045f2b961a09b
-
C:\Users\Admin\Downloads\Unconfirmed 487082.crdownloadFilesize
7.6MB
MD5dbb820772caf0003967ef0f269fbdeb1
SHA131992bd4977a7dfeba67537a2da6c9ca64bc304c
SHA256b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc
SHA512e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f
-
C:\Windows\Installer\MSI4249.tmpFilesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
C:\Windows\Installer\MSI42D7.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI4932.tmpFilesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
-
C:\Windows\Temp\{26B1C079-495A-41F1-B41D-982A08E93B2E}\.ba\logo.pngFilesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
C:\Windows\Temp\{26B1C079-495A-41F1-B41D-982A08E93B2E}\.ba\wixstdba.dllFilesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
C:\Windows\Temp\{A8B35493-9ECD-476F-B6A8-19AC51847589}\.cr\vc_redist.x64.exeFilesize
634KB
MD5cb264f7d256b42a54b2129b7a02c1ce3
SHA1d71459e24185f70b0c8647758663b1116a898412
SHA256d6aaee30c9b7edeac6939f78f4a55683c6358d9cc03dac487880d01f18700e83
SHA5124f623f5d21bc216f3dd040e6d0c663a8ea37efe5d0ce5f4aeb1ef5c1f7c873e19d1abc979d3e40d4dc70e2e4f0fc9a1b114b17d9eb852ea9a41d0f84356cd7cb
-
\??\pipe\LOCAL\crashpad_3384_RVWOFEQRAWCDHIWSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/628-4396-0x0000022D961B0000-0x0000022D961E0000-memory.dmpFilesize
192KB
-
memory/1640-4482-0x00000288180F0000-0x0000028818120000-memory.dmpFilesize
192KB
-
memory/3572-4657-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3572-4663-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3572-4662-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3572-4664-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3572-4656-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3572-4658-0x000001964ADD0000-0x000001964ADD1000-memory.dmpFilesize
4KB
-
memory/3984-3993-0x0000000074740000-0x0000000074EF0000-memory.dmpFilesize
7.7MB
-
memory/3984-3-0x0000000074740000-0x0000000074EF0000-memory.dmpFilesize
7.7MB
-
memory/3984-0-0x000000007474E000-0x000000007474F000-memory.dmpFilesize
4KB
-
memory/3984-2382-0x000000007474E000-0x000000007474F000-memory.dmpFilesize
4KB
-
memory/3984-2383-0x0000000074740000-0x0000000074EF0000-memory.dmpFilesize
7.7MB
-
memory/3984-2522-0x0000000006A20000-0x0000000006A32000-memory.dmpFilesize
72KB
-
memory/3984-1-0x0000000000820000-0x00000000008EE000-memory.dmpFilesize
824KB
-
memory/3984-2-0x00000000057A0000-0x0000000005D44000-memory.dmpFilesize
5.6MB
-
memory/3984-2475-0x0000000006530000-0x00000000065C2000-memory.dmpFilesize
584KB
-
memory/3984-2476-0x00000000089A0000-0x00000000089AA000-memory.dmpFilesize
40KB
-
memory/4832-4007-0x000001D5C5980000-0x000001D5C59FE000-memory.dmpFilesize
504KB
-
memory/4832-3994-0x000001D5AA700000-0x000001D5AA71A000-memory.dmpFilesize
104KB
-
memory/4832-4303-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4346-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4272-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4268-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4400-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4413-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4263-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4259-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4021-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4022-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4227-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4228-0x00007FFE69500000-0x00007FFE69524000-memory.dmpFilesize
144KB
-
memory/4832-4427-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4315-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4020-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-3998-0x000001D5C51C0000-0x000001D5C56FC000-memory.dmpFilesize
5.2MB
-
memory/4832-4003-0x000001D5C4E70000-0x000001D5C4F2A000-memory.dmpFilesize
744KB
-
memory/4832-4005-0x000001D5C4C20000-0x000001D5C4C2E000-memory.dmpFilesize
56KB
-
memory/4832-4637-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4652-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/4832-4025-0x000001D5C5950000-0x000001D5C5958000-memory.dmpFilesize
32KB
-
memory/4832-4026-0x000001D5C8CA0000-0x000001D5C8CD8000-memory.dmpFilesize
224KB
-
memory/4832-4027-0x000001D5C8C60000-0x000001D5C8C6E000-memory.dmpFilesize
56KB
-
memory/4832-4018-0x0000000180000000-0x0000000180AC0000-memory.dmpFilesize
10.8MB
-
memory/5804-4054-0x00007FFE8CBD0000-0x00007FFE8CBD1000-memory.dmpFilesize
4KB
-
memory/5804-4246-0x000001FE8C1B0000-0x000001FE8C1E0000-memory.dmpFilesize
192KB
-
memory/5952-4108-0x00007FFE8CBD0000-0x00007FFE8CBD1000-memory.dmpFilesize
4KB
-
memory/5952-4107-0x00007FFE8E860000-0x00007FFE8E861000-memory.dmpFilesize
4KB
-
memory/5952-4247-0x0000028F5A200000-0x0000028F5A230000-memory.dmpFilesize
192KB