Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20/06/2024, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
SolaraBootstrapper.exe
Resource
win10v2004-20240226-en
General
-
Target
SolaraBootstrapper.exe
-
Size
798KB
-
MD5
7416a188b82e9dc4b020a59d3c9267d5
-
SHA1
15b67c0e13667dd00f2f1d1d2d3132e629e746f3
-
SHA256
6a6990c2da4da8f8870da3e33865a1dff8f16874793b232971194c074f3b7838
-
SHA512
3f2616216e8dc70362cc6d3f8e76a009108fe04d98697a744c131b76f3c693364ef2a80716ccd9a8f9987d2ac10b0316b0328a0066260055fcbadcd449aaf704
-
SSDEEP
12288:pfSmzhHoAX5TyQvgwRojAojGdJaTGLLvlguxD:smzhHWQDRojAojGddLL
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 17 IoCs
pid Process 3768 vc_redist.x64.exe 4940 vc_redist.x64.exe 3476 MicrosoftEdgeWebview2Setup.exe 3272 MicrosoftEdgeUpdate.exe 4100 MicrosoftEdgeUpdate.exe 4172 MicrosoftEdgeUpdate.exe 3816 MicrosoftEdgeUpdateComRegisterShell64.exe 316 MicrosoftEdgeUpdateComRegisterShell64.exe 1904 MicrosoftEdgeUpdateComRegisterShell64.exe 2192 MicrosoftEdgeUpdate.exe 1892 MicrosoftEdgeUpdate.exe 392 MicrosoftEdgeUpdate.exe 3996 MicrosoftEdgeUpdate.exe 984 MicrosoftEdge_X64_126.0.2592.61.exe 5100 setup.exe 4944 setup.exe 3580 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 21 IoCs
pid Process 3748 MsiExec.exe 3748 MsiExec.exe 5024 MsiExec.exe 5024 MsiExec.exe 5024 MsiExec.exe 5024 MsiExec.exe 5024 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 3748 MsiExec.exe 4940 vc_redist.x64.exe 3272 MicrosoftEdgeUpdate.exe 3816 MicrosoftEdgeUpdateComRegisterShell64.exe 4172 MicrosoftEdgeUpdate.exe 316 MicrosoftEdgeUpdateComRegisterShell64.exe 4172 MicrosoftEdgeUpdate.exe 1904 MicrosoftEdgeUpdateComRegisterShell64.exe 4172 MicrosoftEdgeUpdate.exe 392 MicrosoftEdgeUpdate.exe 1892 MicrosoftEdgeUpdate.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 7 3276 msiexec.exe 9 3276 msiexec.exe 12 3276 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 MicrosoftEdgeUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\Locales\af.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\Locales\pl.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\normalize-windows-path.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\lib\extract_description.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSSettings_test.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\parser.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\vulkan-1.dll setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minimatch\LICENSE msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\msedgeupdateres_bn.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\Locales\hi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\delegatedWebFeatures.sccd setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\VisualElements\LogoCanary.png setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\is-cidr\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\safe.js msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\readable.js msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\psuser.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\errors.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\node_modules\minimatch\minimatch.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\identity\provider.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\read.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\file.d.ts msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\msedgeupdateres_sr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\msedgeupdateres_tr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\msedgeupdateres_sr-Latn-RS.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\themes.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\Installer\setup.exe setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-columns\color.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ip\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-dist-tag.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\polyfill.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\types.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\imurmurhash\imurmurhash.js msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\msedgeupdateres_it.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\http-cache-semantics\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\from-url.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\exit-handler.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\install.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\once\once.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\parse-conflict-json\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\pnpm.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\provenance.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.61\Locales\kok.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\json.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\socks-proxy-agent\dist\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\node.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-pkg.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ieee754\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\reify.js msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.61\Locales\gl.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\common\owner.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-help.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minimatch\minimatch.js msiexec.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI98DC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2A0.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\Installer\e578a42.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F42.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI93F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\e578a3e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8F31.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSI9484.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB419.tmp msiexec.exe File created C:\Windows\Installer\e578a3e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8E75.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI929E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\ = "PSFactoryBuffer" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3052 SolaraBootstrapper.exe 3052 SolaraBootstrapper.exe 3276 msiexec.exe 3276 msiexec.exe 3272 MicrosoftEdgeUpdate.exe 3272 MicrosoftEdgeUpdate.exe 3272 MicrosoftEdgeUpdate.exe 3272 MicrosoftEdgeUpdate.exe 3272 MicrosoftEdgeUpdate.exe 3272 MicrosoftEdgeUpdate.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3052 SolaraBootstrapper.exe Token: SeShutdownPrivilege 1020 msiexec.exe Token: SeIncreaseQuotaPrivilege 1020 msiexec.exe Token: SeSecurityPrivilege 3276 msiexec.exe Token: SeCreateTokenPrivilege 1020 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1020 msiexec.exe Token: SeLockMemoryPrivilege 1020 msiexec.exe Token: SeIncreaseQuotaPrivilege 1020 msiexec.exe Token: SeMachineAccountPrivilege 1020 msiexec.exe Token: SeTcbPrivilege 1020 msiexec.exe Token: SeSecurityPrivilege 1020 msiexec.exe Token: SeTakeOwnershipPrivilege 1020 msiexec.exe Token: SeLoadDriverPrivilege 1020 msiexec.exe Token: SeSystemProfilePrivilege 1020 msiexec.exe Token: SeSystemtimePrivilege 1020 msiexec.exe Token: SeProfSingleProcessPrivilege 1020 msiexec.exe Token: SeIncBasePriorityPrivilege 1020 msiexec.exe Token: SeCreatePagefilePrivilege 1020 msiexec.exe Token: SeCreatePermanentPrivilege 1020 msiexec.exe Token: SeBackupPrivilege 1020 msiexec.exe Token: SeRestorePrivilege 1020 msiexec.exe Token: SeShutdownPrivilege 1020 msiexec.exe Token: SeDebugPrivilege 1020 msiexec.exe Token: SeAuditPrivilege 1020 msiexec.exe Token: SeSystemEnvironmentPrivilege 1020 msiexec.exe Token: SeChangeNotifyPrivilege 1020 msiexec.exe Token: SeRemoteShutdownPrivilege 1020 msiexec.exe Token: SeUndockPrivilege 1020 msiexec.exe Token: SeSyncAgentPrivilege 1020 msiexec.exe Token: SeEnableDelegationPrivilege 1020 msiexec.exe Token: SeManageVolumePrivilege 1020 msiexec.exe Token: SeImpersonatePrivilege 1020 msiexec.exe Token: SeCreateGlobalPrivilege 1020 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeRestorePrivilege 3276 msiexec.exe Token: SeTakeOwnershipPrivilege 3276 msiexec.exe Token: SeSecurityPrivilege 948 wevtutil.exe Token: SeBackupPrivilege 948 wevtutil.exe Token: SeSecurityPrivilege 1740 wevtutil.exe Token: SeBackupPrivilege 1740 wevtutil.exe Token: SeRestorePrivilege 3276 msiexec.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1020 3052 SolaraBootstrapper.exe 74 PID 3052 wrote to memory of 1020 3052 SolaraBootstrapper.exe 74 PID 3052 wrote to memory of 1020 3052 SolaraBootstrapper.exe 74 PID 3276 wrote to memory of 3748 3276 msiexec.exe 77 PID 3276 wrote to memory of 3748 3276 msiexec.exe 77 PID 3276 wrote to memory of 5024 3276 msiexec.exe 78 PID 3276 wrote to memory of 5024 3276 msiexec.exe 78 PID 3276 wrote to memory of 5024 3276 msiexec.exe 78 PID 3276 wrote to memory of 1648 3276 msiexec.exe 79 PID 3276 wrote to memory of 1648 3276 msiexec.exe 79 PID 3276 wrote to memory of 1648 3276 msiexec.exe 79 PID 1648 wrote to memory of 948 1648 MsiExec.exe 80 PID 1648 wrote to memory of 948 1648 MsiExec.exe 80 PID 1648 wrote to memory of 948 1648 MsiExec.exe 80 PID 948 wrote to memory of 1740 948 wevtutil.exe 82 PID 948 wrote to memory of 1740 948 wevtutil.exe 82 PID 3052 wrote to memory of 3768 3052 SolaraBootstrapper.exe 85 PID 3052 wrote to memory of 3768 3052 SolaraBootstrapper.exe 85 PID 3052 wrote to memory of 3768 3052 SolaraBootstrapper.exe 85 PID 3768 wrote to memory of 4940 3768 vc_redist.x64.exe 86 PID 3768 wrote to memory of 4940 3768 vc_redist.x64.exe 86 PID 3768 wrote to memory of 4940 3768 vc_redist.x64.exe 86 PID 3052 wrote to memory of 3476 3052 SolaraBootstrapper.exe 87 PID 3052 wrote to memory of 3476 3052 SolaraBootstrapper.exe 87 PID 3052 wrote to memory of 3476 3052 SolaraBootstrapper.exe 87 PID 3476 wrote to memory of 3272 3476 MicrosoftEdgeWebview2Setup.exe 88 PID 3476 wrote to memory of 3272 3476 MicrosoftEdgeWebview2Setup.exe 88 PID 3476 wrote to memory of 3272 3476 MicrosoftEdgeWebview2Setup.exe 88 PID 3272 wrote to memory of 4100 3272 MicrosoftEdgeUpdate.exe 89 PID 3272 wrote to memory of 4100 3272 MicrosoftEdgeUpdate.exe 89 PID 3272 wrote to memory of 4100 3272 MicrosoftEdgeUpdate.exe 89 PID 3272 wrote to memory of 4172 3272 MicrosoftEdgeUpdate.exe 90 PID 3272 wrote to memory of 4172 3272 MicrosoftEdgeUpdate.exe 90 PID 3272 wrote to memory of 4172 3272 MicrosoftEdgeUpdate.exe 90 PID 4172 wrote to memory of 3816 4172 MicrosoftEdgeUpdate.exe 91 PID 4172 wrote to memory of 3816 4172 MicrosoftEdgeUpdate.exe 91 PID 4172 wrote to memory of 316 4172 MicrosoftEdgeUpdate.exe 92 PID 4172 wrote to memory of 316 4172 MicrosoftEdgeUpdate.exe 92 PID 4172 wrote to memory of 1904 4172 MicrosoftEdgeUpdate.exe 93 PID 4172 wrote to memory of 1904 4172 MicrosoftEdgeUpdate.exe 93 PID 3272 wrote to memory of 2192 3272 MicrosoftEdgeUpdate.exe 94 PID 3272 wrote to memory of 2192 3272 MicrosoftEdgeUpdate.exe 94 PID 3272 wrote to memory of 2192 3272 MicrosoftEdgeUpdate.exe 94 PID 3272 wrote to memory of 1892 3272 MicrosoftEdgeUpdate.exe 95 PID 3272 wrote to memory of 1892 3272 MicrosoftEdgeUpdate.exe 95 PID 3272 wrote to memory of 1892 3272 MicrosoftEdgeUpdate.exe 95 PID 392 wrote to memory of 3996 392 MicrosoftEdgeUpdate.exe 97 PID 392 wrote to memory of 3996 392 MicrosoftEdgeUpdate.exe 97 PID 392 wrote to memory of 3996 392 MicrosoftEdgeUpdate.exe 97 PID 392 wrote to memory of 984 392 MicrosoftEdgeUpdate.exe 100 PID 392 wrote to memory of 984 392 MicrosoftEdgeUpdate.exe 100 PID 984 wrote to memory of 5100 984 MicrosoftEdge_X64_126.0.2592.61.exe 101 PID 984 wrote to memory of 5100 984 MicrosoftEdge_X64_126.0.2592.61.exe 101 PID 5100 wrote to memory of 4944 5100 setup.exe 102 PID 5100 wrote to memory of 4944 5100 setup.exe 102 PID 392 wrote to memory of 3580 392 MicrosoftEdgeUpdate.exe 103 PID 392 wrote to memory of 3580 392 MicrosoftEdgeUpdate.exe 103 PID 392 wrote to memory of 3580 392 MicrosoftEdgeUpdate.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\msiexec.exe"msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\Temp\{522ECAA1-ED9E-4B25-8986-A9A72B099339}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{522ECAA1-ED9E-4B25-8986-A9A72B099339}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4940
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU3B3F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Modifies registry class
PID:4100
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3816
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:316
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1904
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTI0QTlFMEEtQTE5RC00OUU4LUFEMEYtNTA0Mzc2ODczQTlBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0QzMwQkM3RC03QTlFLTQ5NEMtQUYwNi1FRkNDQjJFMjExNkZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTk1Nzc2ODI2IiBpbnN0YWxsX3RpbWVfbXM9IjQ1MyIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Checks system information in the registry
PID:2192
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A24A9E0A-A19D-49E8-AD0F-504376873A9A}" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 58C56016D05E40C5EC8D5DF97A4A16452⤵
- Loads dropped DLL
PID:3748
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 49B0349B5D728D3CCD2B5A14E80D68682⤵
- Loads dropped DLL
PID:5024
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB5B6882F58BD993F1809E6E2C3C4BFA E Global\MSI00002⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\syswow64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTI0QTlFMEEtQTE5RC00OUU4LUFEMEYtNTA0Mzc2ODczQTlBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTYzRkI2ODQtOTVGRC00RkMzLUJEMzctMjk5OUE4MjkwRTM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlFFTVUiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ijc3IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTIyMzM3MTIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1NjcwNjU4MDAwOTU3NzAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTk4NTg5NTYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3996
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\MicrosoftEdge_X64_126.0.2592.61.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\MicrosoftEdge_X64_126.0.2592.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\EDGEMITMP_765E9.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\EDGEMITMP_765E9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\MicrosoftEdge_X64_126.0.2592.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\EDGEMITMP_765E9.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\EDGEMITMP_765E9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.62 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8C044056-A784-45C9-84EE-88177380E699}\EDGEMITMP_765E9.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.61 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff62239aa40,0x7ff62239aa4c,0x7ff62239aa584⤵
- Executes dropped EXE
PID:4944
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTI0QTlFMEEtQTE5RC00OUU4LUFEMEYtNTA0Mzc2ODczQTlBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBMjlGODA2RC04MTMyLTQ3Q0YtODU0MS00MzhGOTRCMDBENjl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNi4wLjI1OTIuNjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNDE0MzE3ODUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQxNTg3ODUxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3NDI3MzMwNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNzEzNjlkZjQtOWU5Zi00YTFiLTlhZjgtOWE4YjVhYTQ1NDhkP1AxPTE3MTk0OTkzODImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9WU0zRUdLcUViR0kzMFFuS205UG8wTW9ZQzFwWmQxM0JTNW9uNVlUTW9sOWU0OVZFTVg3MmZlU0RyR1VMRzJWSENKZ1BOb1EybG95SiUyYmZuSVVqaVlCZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjkwNzQ4MCIgdG90YWw9IjE3MjkwNzQ4MCIgZG93bmxvYWRfdGltZV9tcz0iMTkxMzMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDc0NDI5Mjc2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ4ODQ1NjI1MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkyMDY3NTQ2MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijg5MSIgZG93bmxvYWRfdGltZV9tcz0iMjMyODQiIGRvd25sb2FkZWQ9IjE3MjkwNzQ4MCIgdG90YWw9IjE3MjkwNzQ4MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDMyMjIiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3580
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD568c86d998cf870a151ae6b3e32949ba2
SHA166c4d8d9eeea8f7ac827d1b244c6c97fba978193
SHA256cf9332deae2e5aa11b7eeb93839ba5cf83c376ea8fea1b75ff00b9d381c93265
SHA512c0fae91e6c53009a61e8d4ef9d64f852bfa4095b06b825eaa6bad774994c100f1d50c83ec47cc788d8d3ad30f45986de545bffaaf3e9cb07435a8ca0047c8c34
-
Filesize
6.5MB
MD5f9e45fe262a291c37f52e1baf1cbb75c
SHA12c3a47de71610e3ad80e34fa7d0af9690d56d8ea
SHA25676974a5e0e00af7c5d759a30b04ec614e819a4fcbe418fb1312b0426b87d0b26
SHA512a7ea36dc3c2322f5bdc97ed4c2cf4d1a6d8261f80ad774155e557127b0b3491aa6fa9bab14bc2f65d483bb9a3680ff0c8f8920b0920b3058e0aa5f992b22f94c
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD5687ccc0cc0a4c1de97e7f342e7a03baa
SHA190e600e88b4c9e5bb5514a4e90985a981884f323
SHA256ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
SHA5124da91ee55de7abb6ce59203edd9ae7e6fcacd5528ac26d9e0bfbd12169db74758a9bc3fde437e3c1d10afc95d74b04b0e94586472b0a0bb15b738f5e6ec41d8d
-
Filesize
201KB
MD5e3f7c1c2e2013558284331586ba2bbb2
SHA16ebf0601e1c667f8d0b681b0321a73e8f4e91fa3
SHA256d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
SHA5127d4fd7ad06b05d79211144cbaa0047bdb4910212565b79f292a6bea652735dacf69435b24c73bc679cbdad4207f6352726eb297a1e7af4f7eef14dbc8a2ca42d
-
Filesize
212KB
MD5a177a23ca2ed6147d379d023725aff99
SHA11a789e5ef7bf9f15f2ccbac5f9cf3750ee41f301
SHA2569c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
SHA512c508ffd3e2cc953d857a2128e29dfdfe0f9e729da38c9cc3022c4376342aec946c6e79176e7885f6637008573c85339bdc8a9e261b3811887ecf5a7dd78383c3
-
Filesize
258KB
MD54f840a334c7f6d2a6cba74f201e83a7f
SHA1cb032c7b1293190f8f1cd466f6ded4bbe71c47a1
SHA2562ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
SHA512575c20fcdbebb16bcd17a137a656769d355a81817e7fa3743981976998e00bdf3ce42bbfa046c42a835e9e9e7a10ef6f8d7b306de9940fa332817cb2885db833
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.1MB
MD51125e435063e7c722c0079fdf0a5b751
SHA19b1c36d2b7df507a027314ece2ef96f5b775c422
SHA2567d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
SHA512153f096af5c874c00a3c38602fab590eccf885f642040007b67799ef39d919d7cb261fba43a9ffbd68c8824eddea219505d49e05b3dcc70f00e6016a1fbd12b9
-
Filesize
29KB
MD53a8fa737407a1b3671d6c0f6adaabd8a
SHA1b705b27c99349a90d7a379d64fd38679eed6ec30
SHA2565995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
SHA5129872f32a727b248d3edafe303e5290e1bae0c270a988500424221970c0041268c1626ebb94712a0b8ba0f21d2f29d833ab9dbc4db884f7f9af5a5063f94d71b5
-
Filesize
24KB
MD586465afa3ac4958849be859307547f57
SHA19bbde5e4df719b5a7d815dd1704ab8215602f609
SHA256921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
SHA51213e178e317280cbd585261aa22a840ea2203d4ef5c845f4fd6d5b4fbf216d45aae55153aed43c1fe4284d45391c72e580e612347b2903effece8a2252a13b90e
-
Filesize
26KB
MD5819e3c9e056c95b894f1863208d628a2
SHA1596993f5d21cfd92f29e2ea5b0a870dc2ac19917
SHA256588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
SHA5123a7e67248895ac2cbb1874514bffe62a23cdfff2c3674d21589f528ec283ccf3cc2e3abfea0d81f49046c7ba920f3e64cda100c5a20be69b91ce05095b50c06b
-
Filesize
29KB
MD5d1aa2764e05f7c8c88a17bb0cd25b537
SHA12bee78f103faffe3e25ca20c915cc6b46e2134e4
SHA2563dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
SHA51280762e4611b8ac451490e5238c0650be048bf315526ed405d9c5837e5002bd6a9526f335a06c6baa009cba671ecb0613c76dce23086e13333f332480cbd9ced0
-
Filesize
29KB
MD51e4093c3b0af3eed6f95d2620d45bf40
SHA1e29a10ede562f2d057d6fc04c3a286996051a14d
SHA256afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
SHA512843480e2d2b431f32892830c26fc3e4b80656d069f83f9a9df78d10b1e22c9ceca99171360b2baa921d156995d87ea5223f18b11e2a8ac18fabdf905881940b1
-
Filesize
29KB
MD5c30674009659b56bdb6a60f8629f0eb2
SHA14b6fc6ea93620a206a621875513455b57fd24e83
SHA256d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
SHA5128947a9bada21ed2e0f2cf080d58f9473a5c54092a5c1f75ca9523b48143caed346e831714e80466cc2e88513e507aef422d8560b69cbf8663eb21ab05c61707c
-
Filesize
29KB
MD5a8817334810c093e0c280e2a61caf36b
SHA19b3b2a8e33de3fa8df0b6b6ab4a40ab1d088ab28
SHA25618d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
SHA51224ee9a0c29d42c96ccec7f4f3322c3b6a2ed0e4d68b17a5b424a364f789adaa8f1404784c8feae77986cd0be39579dacc9ca89a3fa868bb0bf11d94c95f0bb23
-
Filesize
29KB
MD54d2988ce0b2cf5cb02269a2455e1174b
SHA1d89cd05805965648c9e7b8bb4bc8bd3605ce2d4a
SHA256cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
SHA51264cee7e579367faca4864ebb5feb9dee310915f8640780a5a52c19f5c68d817adab7ef357913a68fe841a3b2e801e85de173a37402cdd49cf35319571ff6ce44
-
Filesize
29KB
MD53e817089a18c72bd505dd6bbe5ce6163
SHA12c21b568c2fda5e475a1a996b73874ba6fe420dd
SHA2567c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
SHA51220534eee7c59a9cdb595c3f6d01abc8cfa534aaf84a693d3b011e4dada3fde080142a95ba036270a6a2ad2b65e6fdb18b08e53552715cc4edfcb87662fbf8100
-
Filesize
30KB
MD5e0de8c3f8252202d2f68341290c45e34
SHA11d3322ab111774484be8865c1893dd834c3f52f7
SHA256ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
SHA512bb22666ba675c88715aa1b906f2b356c0d4289723052b942f416d3b56f727666f4fb8cc51609ca96be0c76ffda85cfbdcea917979e8a1ada5a5ba1b82e5bf816
-
Filesize
30KB
MD59e4ddaa68d6d4f210905092096051b36
SHA1f38198c364da7b5ebcc75aafdf42a7d55699d8d4
SHA2568bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
SHA512d65102c0f4337cea443c5f8e65531f0f7b628c5edeff17257b427d1073a1b291d1cc90fe46dc4bbd2c2988f940480d46e5abb2cbb9985bcbafa7e5f3bc727151
-
Filesize
28KB
MD5731cb513cd866dfc65e12446a0d4d62d
SHA1be32570fb7fd50c43cf1ae24e7a35302eb5278fe
SHA256829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
SHA5126357f965c183e89e5a1c485a0e3becf56ab91265241568d7df7fdc1c01f1ac8fa58bd206762ada8cec99b6988eff60c41cf4836290d5e007fff63a69a78de68c
-
Filesize
28KB
MD504ee3ec0e73eae42509bdfb689927610
SHA16176e7ae836dcacea10f7004b04ba85e3e081da8
SHA2565410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
SHA51289c41d77066fde1cad219603d1bbdd812a65bb0680d3c545ee4cb63135486296f1af934a69161e76ca53d00037729e75bdcc22a2eca954eba98cf3f34af5d839
-
Filesize
29KB
MD59fa41c3ba8bbd84e85f71c3cd377d90d
SHA1363c1d61c84fee42987193e8edeffa522eccbfdc
SHA256157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
SHA51234569a917bf08ac7d50add115b09cd8bf4583a3bc7652fa54c1cd606cb94e752f4e4e278fbb99ea1e41e2d712f82893ca5f59bbed05a57c8d29b2d7037d835e5
-
Filesize
31KB
MD5896c0f7b03a6cd211fea53ecc71a1308
SHA1434eac60a992ea77945a77964050a5d0e41d48b2
SHA25684ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
SHA5127d2f9fc0086b3dc60275c6a2e17b0562626a57fb080dc1bc4cd5ad80c2501f366e89533aa961613eacd3a0bce343bf831e8cfa3d3a691c33481042b1ee02908f
-
Filesize
31KB
MD58cb60db631b0939688f39e76564505cc
SHA16dee577de716460737f7a330f440880b4e73c5c8
SHA256e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
SHA512d43216c1a8ed2daf51d70d476b789a3797bd62f69c1a556e306dfccc41efea73117eafb970010d7db151cd3ebfb7cd82de01efb4e2a2c0757b2027732a3361f5
-
Filesize
27KB
MD51b79536b20df86a2bd8b232abe07d533
SHA1a9d24de616055f9800d5c4bc902cb2d0f625d178
SHA256fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
SHA512ac4704fade4879992f0a67888e1e4098be2879e5e3ce2bd80275ce68729f0037497d975e1ececb587ace4d72f3e71b038f616725831d4fca12280d583cd77d7b
-
Filesize
27KB
MD5a430ce95b80c07bb729463063e0c7c48
SHA1cc488bdc18c191d88dd93e45bb85fda19d496591
SHA256c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
SHA512cc9c24b95d079a949a8e725002494b0c75c19bce9ec6457cb4307f5803b7433eed738944f1baf770df8e034212224b1d9662fa533aa5bc5c01568d192fa49efc
-
Filesize
29KB
MD531177139af7d1da131c31d7d5cbe8099
SHA1113f3b38baeab35d2d0f51f1238f5b9e11402f26
SHA25639e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
SHA5126828a1cab2fdefe642a0b58f47c31e02b9dba7b15ad28cdb8039b194d9a86e2d24ff0e658fdf982e3d2d4208a2b57eb7546136e4739e64d714939c14a3d58410
-
Filesize
29KB
MD5dd3dd031e05a54c4bbf6660dd8053608
SHA1f32870bb0f7f522fd536c4ffae8c39c9d2f266f1
SHA2562d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
SHA5127b0bb0ae619baea45cddab042d10d7e4b394c70a29c01632585fec7ff9aaa54a50a8fbc894f02af5e2130cff11c4573cf41ab6b5fc4c29392b69e72212c41c2d
-
Filesize
28KB
MD52e1b7c75e1ee567906a62eb19ee4308d
SHA110b77bc1040db4a3712a94c2e5ba56be3a54bfd4
SHA25683a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
SHA5129bcbb626945390ca07c99b4a698036b2a59869040944866edb893f4e5f7a6524b8980183f9825b33bafa41b10165b7ef6d20dd7750e38edd880fc22362110c08
-
Filesize
280B
MD52e96cbbb8ac5495d1bdf7567f904949b
SHA1918e0c18401be5fb92d41baaba23531b38d1a7fe
SHA25660edfed55b6615d07d0db56e7f4ee4127aad752f27749048f4bb7f3d0ad93f1d
SHA512b1aa62b852ca46c6c41ba86efbfff35a25587140279371e32661f90feaa02c265b4107a71042a6b26e4f811bcab29cb3efa314c9c00028077b8707f097c93631
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
15KB
MD52dc083280b7941255ccb62e98afe0c3f
SHA171bc86b7d9c60b44dfb8d15e9f230ac8c15359f9
SHA256146d66392c61ffd3a56b9b928d45b756f37b3e6d55376b1760597374dbf4ba34
SHA512688faf6c5cd568778901f4a3541f927aac0826c50a3d28e101583407bcc9559d57bfedd0ceaf9cc558370c3e50d179c59e1297a7099b373a33346940a8176433
-
Filesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
Filesize
133B
MD535b86e177ab52108bd9fed7425a9e34a
SHA176a1f47a10e3ab829f676838147875d75022c70c
SHA256afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
SHA5123c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
-
Filesize
1.6MB
MD5db7fb67fcec9f1c442de25f3ad59f50c
SHA1b600aa26d1cded59760304c6d77f4ff75722eabd
SHA256c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
SHA512c14ec7d252a6f201dfea476d302fbc5140713cb4ea7bc8d4e610bfd806b3fa3c141153e2e9b8cb36255fba1fab4d4400ed83f5f5c1228d77d77bace41d5de7fe
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
24.1MB
MD5e091e9e5ede4161b45b880ccd6e140b0
SHA11a18b960482c2a242df0e891de9e3a125e439122
SHA256cee28f29f904524b7f645bcec3dfdfe38f8269b001144cd909f5d9232890d33b
SHA512fa8627055bbeb641f634b56059e7b5173e7c64faaa663e050c20d01d708a64877e71cd0b974282c70cb448e877313b1cf0519cf6128c733129b045f2b961a09b
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
-
Filesize
634KB
MD5cb264f7d256b42a54b2129b7a02c1ce3
SHA1d71459e24185f70b0c8647758663b1116a898412
SHA256d6aaee30c9b7edeac6939f78f4a55683c6358d9cc03dac487880d01f18700e83
SHA5124f623f5d21bc216f3dd040e6d0c663a8ea37efe5d0ce5f4aeb1ef5c1f7c873e19d1abc979d3e40d4dc70e2e4f0fc9a1b114b17d9eb852ea9a41d0f84356cd7cb
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2