44caliber | 29b6d8b4e922d49e993bdd6cebc5370fb35ad1c8356188139a0c863825be98d6

Analysis

max time kernel
1800s
max time network
1696s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BleedBootstrapper.exe
Size

216KB
MD5

c985922fbfd599e853e51f20eb1c52af
SHA1

2c1479539a4937c520d5352b245a9fdb01aa6d43
SHA256

29b6d8b4e922d49e993bdd6cebc5370fb35ad1c8356188139a0c863825be98d6
SHA512

8d1420a2b6c51a2bcd1aac3d1387b8f77539bfa9d3e73a8525e8b84439e76debb8081d07dc339415b811a8e0de7f6ccadca1ac6c248aecec4333be464431cc34
SSDEEP

3072:LahKyd2n31d95GWp1icKAArDZz4N9GhbkrNEk5N7AX8VBt3wRW8IbE6Vx2K:LahO3p0yN90QEM

Score

10^/10

44caliber discovery evasion persistence privilege_escalation spyware stealer themida trojan

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1169713279464120370/GUIw2wEmQMllUHEfRf3MNeS3DBNrZN-RuTQ9QbFfAqIZNVHtIlkj1yiD5QqgrIlv8gQi

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 9 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

2348 netsh.exe
2372 netsh.exe
3256 netsh.exe
4692 netsh.exe
3248 netsh.exe
4192 netsh.exe
3380 netsh.exe
3020 netsh.exe
4424 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid	process
2348	netsh.exe
2372	netsh.exe
3256	netsh.exe
4692	netsh.exe
3248	netsh.exe
4192	netsh.exe
3380	netsh.exe
3020	netsh.exe
4424	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SolaraBootstrapper.exeBloxstrap-v2.6.1.exeBloxstrap.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.6.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Bloxstrap.exe

Executes dropped EXE 7 IoCs

Processes:

SolaraBootstrapper.execd57e4c171d6e8f5ea8b8f824a6a7316.exeInsidious.exeBloxstrap-v2.6.1.exeRobloxPlayerBeta.exeBloxstrap.exeRobloxPlayerBeta.exe

pid	process
5200	SolaraBootstrapper.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5884	Insidious.exe
5092	Bloxstrap-v2.6.1.exe
6692	RobloxPlayerBeta.exe
2508	Bloxstrap.exe
2092	RobloxPlayerBeta.exe

Loads dropped DLL 7 IoCs

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
6692	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	themida
behavioral1/memory/5896-2277-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2279-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2280-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2278-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2604-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2797-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2817-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2819-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2829-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2870-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2883-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2926-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-2986-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-3107-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida
behavioral1/memory/5896-6492-0x0000000180000000-0x0000000180A5B000-memory.dmp	themida

Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 208.67.222.222
Destination IP 208.67.222.222
Destination IP 208.67.222.222
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BleedBootstrapper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BleedBootstrapper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

Processes:

flow	ioc
174	raw.githubusercontent.com
251	raw.githubusercontent.com
256	raw.githubusercontent.com
265	raw.githubusercontent.com
121	raw.githubusercontent.com
247	raw.githubusercontent.com
127	raw.githubusercontent.com
175	raw.githubusercontent.com
176	raw.githubusercontent.com
260	raw.githubusercontent.com
126	raw.githubusercontent.com
137	raw.githubusercontent.com
139	raw.githubusercontent.com
206	camo.githubusercontent.com
120	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

129 freegeoip.app
130 freegeoip.app
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

6692 RobloxPlayerBeta.exe
2092 RobloxPlayerBeta.exe

flow	ioc
129	freegeoip.app
130	freegeoip.app

pid	process
6692	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 43 IoCs

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
6692	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

Processes:

msedgewebview2.exe

description	ioc	process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Other	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1166551459\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Social	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_897569749\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Analytics	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_771690951\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_771690951\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Mu\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_116495965\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1166551459\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1883478253\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_116495965\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Mu\Entities	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Advertising	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Mu\Social	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1883478253\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Entities	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_897569749\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\Part-ES	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedgewebview2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

3144 ipconfig.exe
864 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1600 systeminfo.exe

pid	process
3144	ipconfig.exe
864	ipconfig.exe

pid	process
1600	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

msedgewebview2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635416474414538"	msedgewebview2.exe

Modifies registry class 20 IoCs

Processes:

msedge.exeBloxstrap-v2.6.1.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\ = "URL: Roblox Protocol"	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\DefaultIcon	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\DefaultIcon	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\URL Protocol	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open\command	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\URL Protocol	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player	Bloxstrap-v2.6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{B7BE19A2-0210-4339-A822-40A20D257327}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open\command	Bloxstrap-v2.6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\roblox-player\shell\open	Bloxstrap-v2.6.1.exe

NTFS ADS 2 IoCs

Processes:

msedge.exeBloxstrap-v2.6.1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 568755.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:SmartScreen:$DATA	Bloxstrap-v2.6.1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeSolaraBootstrapper.exeInsidious.execd57e4c171d6e8f5ea8b8f824a6a7316.exemsedge.exe

pid	process
3764	msedge.exe
3764	msedge.exe
396	msedge.exe
396	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
4772	msedge.exe
4772	msedge.exe
5756	msedge.exe
5756	msedge.exe
5200	SolaraBootstrapper.exe
5200	SolaraBootstrapper.exe
5200	SolaraBootstrapper.exe
5884	Insidious.exe
5884	Insidious.exe
5884	Insidious.exe
5884	Insidious.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5896	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

Processes:

msedge.exemsedgewebview2.exe

pid	process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
1624	msedgewebview2.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5048	WMIC.exe
Token: SeSecurityPrivilege	5048	WMIC.exe
Token: SeTakeOwnershipPrivilege	5048	WMIC.exe
Token: SeLoadDriverPrivilege	5048	WMIC.exe
Token: SeSystemProfilePrivilege	5048	WMIC.exe
Token: SeSystemtimePrivilege	5048	WMIC.exe
Token: SeProfSingleProcessPrivilege	5048	WMIC.exe
Token: SeIncBasePriorityPrivilege	5048	WMIC.exe
Token: SeCreatePagefilePrivilege	5048	WMIC.exe
Token: SeBackupPrivilege	5048	WMIC.exe
Token: SeRestorePrivilege	5048	WMIC.exe
Token: SeShutdownPrivilege	5048	WMIC.exe
Token: SeDebugPrivilege	5048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5048	WMIC.exe
Token: SeRemoteShutdownPrivilege	5048	WMIC.exe
Token: SeUndockPrivilege	5048	WMIC.exe
Token: SeManageVolumePrivilege	5048	WMIC.exe
Token: 33	5048	WMIC.exe
Token: 34	5048	WMIC.exe
Token: 35	5048	WMIC.exe
Token: 36	5048	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5048	WMIC.exe
Token: SeSecurityPrivilege	5048	WMIC.exe
Token: SeTakeOwnershipPrivilege	5048	WMIC.exe
Token: SeLoadDriverPrivilege	5048	WMIC.exe
Token: SeSystemProfilePrivilege	5048	WMIC.exe
Token: SeSystemtimePrivilege	5048	WMIC.exe
Token: SeProfSingleProcessPrivilege	5048	WMIC.exe
Token: SeIncBasePriorityPrivilege	5048	WMIC.exe
Token: SeCreatePagefilePrivilege	5048	WMIC.exe
Token: SeBackupPrivilege	5048	WMIC.exe
Token: SeRestorePrivilege	5048	WMIC.exe
Token: SeShutdownPrivilege	5048	WMIC.exe
Token: SeDebugPrivilege	5048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5048	WMIC.exe
Token: SeRemoteShutdownPrivilege	5048	WMIC.exe
Token: SeUndockPrivilege	5048	WMIC.exe
Token: SeManageVolumePrivilege	5048	WMIC.exe
Token: 33	5048	WMIC.exe
Token: 34	5048	WMIC.exe
Token: 35	5048	WMIC.exe
Token: 36	5048	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3448	WMIC.exe
Token: SeSecurityPrivilege	3448	WMIC.exe
Token: SeTakeOwnershipPrivilege	3448	WMIC.exe
Token: SeLoadDriverPrivilege	3448	WMIC.exe
Token: SeSystemProfilePrivilege	3448	WMIC.exe
Token: SeSystemtimePrivilege	3448	WMIC.exe
Token: SeProfSingleProcessPrivilege	3448	WMIC.exe
Token: SeIncBasePriorityPrivilege	3448	WMIC.exe
Token: SeCreatePagefilePrivilege	3448	WMIC.exe
Token: SeBackupPrivilege	3448	WMIC.exe
Token: SeRestorePrivilege	3448	WMIC.exe
Token: SeShutdownPrivilege	3448	WMIC.exe
Token: SeDebugPrivilege	3448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3448	WMIC.exe
Token: SeRemoteShutdownPrivilege	3448	WMIC.exe
Token: SeUndockPrivilege	3448	WMIC.exe
Token: SeManageVolumePrivilege	3448	WMIC.exe
Token: 33	3448	WMIC.exe
Token: 34	3448	WMIC.exe
Token: 35	3448	WMIC.exe
Token: 36	3448	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3448	WMIC.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

msedge.exeBloxstrap-v2.6.1.exeBloxstrap.exe

pid	process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
5092	Bloxstrap-v2.6.1.exe
2508	Bloxstrap.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exeBloxstrap-v2.6.1.exeBloxstrap.exe

pid	process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
5092	Bloxstrap-v2.6.1.exe
2508	Bloxstrap.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

6692 RobloxPlayerBeta.exe
2092 RobloxPlayerBeta.exe

pid	process
6692	RobloxPlayerBeta.exe
2092	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BleedBootstrapper.execmd.exemsedge.exe

description	pid	process	target process
PID 1500 wrote to memory of 1840	1500	BleedBootstrapper.exe	cmd.exe
PID 1500 wrote to memory of 1840	1500	BleedBootstrapper.exe	cmd.exe
PID 1840 wrote to memory of 4932	1840	cmd.exe	nslookup.exe
PID 1840 wrote to memory of 4932	1840	cmd.exe	nslookup.exe
PID 1840 wrote to memory of 4780	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4780	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3144	1840	cmd.exe	ipconfig.exe
PID 1840 wrote to memory of 3144	1840	cmd.exe	ipconfig.exe
PID 1840 wrote to memory of 864	1840	cmd.exe	ipconfig.exe
PID 1840 wrote to memory of 864	1840	cmd.exe	ipconfig.exe
PID 1840 wrote to memory of 1628	1840	cmd.exe	find.exe
PID 1840 wrote to memory of 1628	1840	cmd.exe	find.exe
PID 1840 wrote to memory of 5048	1840	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 5048	1840	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 3448	1840	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 3448	1840	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1600	1840	cmd.exe	systeminfo.exe
PID 1840 wrote to memory of 1600	1840	cmd.exe	systeminfo.exe
PID 1840 wrote to memory of 4424	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4424	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3380	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3380	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 2348	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 2348	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 2372	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 2372	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3256	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3256	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4692	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4692	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3248	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3248	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4192	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 4192	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3020	1840	cmd.exe	netsh.exe
PID 1840 wrote to memory of 3020	1840	cmd.exe	netsh.exe
PID 396 wrote to memory of 4368	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 4368	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe
PID 396 wrote to memory of 1912	396	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\BleedBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\BleedBootstrapper.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SYSTEM32\cmd.exe
cmd /c Malware.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\nslookup.exe
nslookup myip.opendns.com resolver1.opendns.com
3⤵
PID:4932

C:\Windows\system32\netsh.exe
netsh wlan show profiles
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4780

C:\Windows\system32\ipconfig.exe
ipconfig
3⤵
- Gathers network information
PID:3144

C:\Windows\system32\ipconfig.exe
ipconfig
3⤵
- Gathers network information
PID:864

C:\Windows\system32\find.exe
find /i "IPv4"
3⤵
PID:1628

C:\Windows\System32\Wbem\WMIC.exe
wmic diskdrive get size
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\system32\systeminfo.exe
systeminfo
3⤵
- Gathers system information
PID:1600

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4424

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3380

C:\Windows\system32\netsh.exe
netsh firewall set opmode disable
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2348

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=DISABLE
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2372

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3256

C:\Windows\system32\netsh.exe
netsh advfirewall set domainprofile state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4692

C:\Windows\system32\netsh.exe
netsh advfirewall set privateprofile state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3248

C:\Windows\system32\netsh.exe
netsh advfirewall set publicprofile state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4192

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state off
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff366b46f8,0x7fff366b4708,0x7fff366b4718
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
2⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
2⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
2⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3488 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
2⤵
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
2⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
2⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
2⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
2⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6352 /prefetch:8
2⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
2⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3636 /prefetch:8
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,11358797731517308850,16588431557977663204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 /prefetch:8
2⤵
PID:1252

C:\Users\Admin\Downloads\Bloxstrap-v2.6.1.exe
"C:\Users\Admin\Downloads\Bloxstrap-v2.6.1.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092

C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" --app -channel production
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:6692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6104

C:\Users\Admin\Downloads\Solara\Solara\SolaraB\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\Solara\Solara\SolaraB\SolaraBootstrapper.exe"
1⤵
PID:1132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5200

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5896

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5896.3588.16164986551490893918
4⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1624

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x178,0x17c,0x180,0x154,0x18c,0x7fff273b4ef8,0x7fff273b4f04,0x7fff273b4f10
5⤵
PID:3840

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
5⤵
PID:5200

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1928,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
5⤵
PID:5876

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2240,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8
5⤵
PID:6024

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3716,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
5⤵
PID:5680

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1184,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
5⤵
PID:2396

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4592,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
5⤵
PID:6260

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1028,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
5⤵
PID:6388

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4288,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
5⤵
PID:6180

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2232,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
5⤵
PID:5800

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2228,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
5⤵
PID:3712

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=5012,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
5⤵
PID:6868

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=5084,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
5⤵
PID:6260

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2640,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
5⤵
PID:3048

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4736,i,4331944490881163214,13863716153476093734,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
5⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5884

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2508

C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" --app -channel production
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:2092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1624_116495965\manifest.json
Filesize
43B

MD5
55cf847309615667a4165f3796268958

SHA1
097d7d123cb0658c6de187e42c653ad7d5bbf527

SHA256
54f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877

SHA512
53c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1166551459\manifest.json
Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1236210428\manifest.json
Filesize
132B

MD5
e2e0e30a5061d2e813d389d776cd8ffd

SHA1
90913c06260b62534b42c0e28bac3082cdacd19c

SHA256
7f8c92b4e9da2afa5a089e37797036d18e61e4f02a4885b7887c0b98d464259f

SHA512
000727f5052c846e39c62ae90032db500708e5fec5af24b8cc1f3a9d4102bc7b9be025176f01722a7c72b5e8bf85b0084cab0ebeb00fde03928c4e22869c98cd

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-as.hyb
Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-hi.hyb
Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\hyph-nb.hyb
Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1522640351\manifest.json
Filesize
179B

MD5
273755bb7d5cc315c91f47cab6d88db9

SHA1
c933c95cc07b91294c65016d76b5fa0fa25b323b

SHA256
0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902

SHA512
0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1883478253\manifest.fingerprint
Filesize
66B

MD5
0c9218609241dbaa26eba66d5aaf08ab

SHA1
31f1437c07241e5f075268212c11a566ceb514ec

SHA256
52493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b

SHA512
5d25a1fb8d9e902647673975f13d7ca11e1f00f3c19449973d6b466d333198768e777b8cae5becef5c66c9a0c0ef320a65116b5070c66e3b9844461bb0ffa47f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_1883478253\manifest.json
Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_453717714\manifest.json
Filesize
116B

MD5
178174a0125d4ff3ed5211426f1ea113

SHA1
26f72c5a2f65c767c4edb04d8da62bdadc02e809

SHA256
64986dfeefa8855069e799b28e5523b35c9efcf2ea152a2b03461471c218da1f

SHA512
c0d1d9555f4cd7e9a4b0ee5fc1b069782638ba1680d18ba9c83f796746086b6afdf1400c80b7f586422c3a2a73e51bd04fb250e2db818ef723cb4f7a8b3b15a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_48547093\manifest.json
Filesize
102B

MD5
8062e1b9705b274fd46fcd2dd53efc81

SHA1
61912082d21780e22403555a43408c9a6cafc59a

SHA256
2f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35

SHA512
98609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_771690951\manifest.json
Filesize
79B

MD5
7a74e28cea0b1a8f1969ff4ef4430047

SHA1
11cbf0dd7060e36283dea377fdfb1105068eddda

SHA256
8fd032d30c7b9340e45428cfef8aa409a5df1f5a89be46ec0ab92e7ac53cc2ca

SHA512
f5cb2e55c0ef4e56fa12bfffe78829109214aa213c193da2e75a51d6bbf5bcaef1e74bb40e091abfded7bdb076b2c266212abeb05aaa87f4cfda804f581c2b0f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1624_897569749\manifest.json
Filesize
113B

MD5
b6911958067e8d96526537faed1bb9ef

SHA1
a47b5be4fe5bc13948f891d8f92917e3a11ebb6e

SHA256
341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648

SHA512
62802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062

Download Submit
C:\ProgramData\44\Browsers\Cookies_Edge(80).txt
Filesize
4KB

MD5
e82b8f9192645b6094f61d81ed3177d4

SHA1
b276a39f70c684c2f4206ab444fd0a6c9bb801c5

SHA256
c8537f82d44816eb80aa8afcbe0698a081ebe41d629573741ea3dbd18fcbd1ef

SHA512
71bbc7f00f60f1bcb3b139a4efc2f12da4b889a3d963e85543ba7d7cb5c80191ddea2cd089176ceaeb7921a7fb14250d9ac4ec18c61c119cf53672144e6d4ed8

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
Filesize
79B

MD5
eab6dcc312473d43c2fa8cc41280d79c

SHA1
b4e9ec7e579d06dfcaa5ac616de2751308a153c3

SHA256
0a27d3c9100ab7ab6f03c45daeb0f0cd586f3aeb59daf7986e853f9614e954fe

SHA512
1ce0fdc237110d644bcc8238f184554f25813ccf7142fd312ce96fbb6659081db677b04485bf66d52100136da6bb9688e48b1287455725c7b4950153aa2a4595

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-6b63ea89d2e54fd7\content\sounds\ouch.ogg
Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d0854ad-7e7f-4923-b672-33f4c83b79ec.tmp
Filesize
1KB

MD5
378ef81ae92ea8dceed46247814c36ca

SHA1
6693478165607701d34151c7a068f3ea895ea132

SHA256
e8df1606018e6ce92fa65a682918cd4f19f1fa51a037664ad51464fe0995f5c1

SHA512
bcf5647c56ed38c78043599d2b5250f2df1fa45cfb5ba6c0a810bd312db370dd7939fec41744ac8451eff5b130d7cfd7475fab24bc2c2c6f6c59a062f4f1e769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
36KB

MD5
0e045ce9afca2d76d92e1d18344834be

SHA1
f1ebee178f8b20945fde60e392c53c7deeb5d3f9

SHA256
c5c5edb2479ae74b76265ce50f3288286418225c04a6f35148d3d2238a4fad8c

SHA512
d82c38a003956344659b0b095d6639e081e5a87a7ac822efd2366a39109862bd90661bd448e097deb23a26efa042703fa378f5d7c6701fda9651f2525b942821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Filesize
48KB

MD5
47b6e3b9a667b9dbc766575634849645

SHA1
54c7e7189111bf33c933817d0a97cefe61fe9a6d

SHA256
302ed4f6c8ac4312d71205603c4c28dd2976fafe4c05533c0a08ab3bdb531aa3

SHA512
a12b74ff45f6f9e6abf459863c299e1fafe61dcf2bea8a7331ed9547de14ed29e2deba69b104c6960db93b458f83ba6a4ba454c5514105e7ffb96da96e26e612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Filesize
20KB

MD5
90c7c3cd9f1bda2460a4ce30711d11b7

SHA1
5d62c16f1237f8429a215873602579743cb25aa3

SHA256
f25d0e3f8652167d6a56adb7c8e0441e364dcbc2bb847ad176dc3709d3272450

SHA512
55ee7a7956ddcf57e0e47d83a317ae663a26c5c32d549d2bd3ec4a54f30720ad353ab67b522310f86e1822c628ec5ed654a199d329752d5b8a4eb0c07f78399a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
23KB

MD5
082ea42c1aae3b695989f4b6f6eb0dc7

SHA1
1918fc9585b161ce79c29ff6d2fec39e526a3aa2

SHA256
d87bcc1cb0e666b8812da126e6e308529997c88176123920942b43efade7bc77

SHA512
e6c7b496139c95c43e9af3fbd3b6b4a90a206506a3f823c7003fc42585a404e0323ef85ed6233ac208c066ec528857a8609c36ec6c749cec0702149de2c6f69b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
19KB

MD5
1ec8fb7f6fd9050ab7c803cab2b0b48f

SHA1
6b831a02f8daed957b82c310cf867aa3e77b9816

SHA256
4345ede1557a49c9322e84fcfe2a20821e47003c2b3c214de6ba6d5d42bac73f

SHA512
d4ef769640f071121d07f8942533c7cfbaf4e4a29476d8977fb31d462e986246278fd599b2cb4344713f5ade2b89faed5c728093e31848c9e428601f0ea2f871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Filesize
56KB

MD5
15deb2f227868e22e62aad743443fdd3

SHA1
db87dcd259fad33146bd95dfb7edd39e64e14159

SHA256
13ba113a7d1dbf634b226d5d27c91a86bd8edd5cde9607e95cb173fd38e1b88b

SHA512
fea6d0d7e67435be1a06c7a4af844ee7e1fa6aff96f1fab21a1d1c3ae1cbbed28dbef42af3ce63beebe8342e8acc1eba55e5814cd171651dce53634a5ef07123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
59KB

MD5
4bc7fdb1eed64d29f27a427feea007b5

SHA1
62b5f0e1731484517796e3d512c5529d0af2666b

SHA256
05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6

SHA512
9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
130KB

MD5
b61b5eac4fb168036c99caf0190ec8d3

SHA1
8440a8168362eb742ea3f700bb2b79f7b0b17719

SHA256
3c495df6db16ed46f0f8a9aff100fa9b26e1434016c41b319f0c1009b7ab2e1f

SHA512
cbccd3aa5a1bdfddba5cc38956b5523a422a1151cdd0680336ab94f07aabecd1695062a0953c32c8209949ea6a4859c625c6deffe5108e8d5e48290017e51874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
17KB

MD5
e2e9087eca5b4988e289dcb6c3373722

SHA1
5e0800225db517d5428855102502216df1c8193e

SHA256
feb51cf7fd6e7c2033481adde36be8fdecfb9aea6eedee5f5f4abc81ba802817

SHA512
b7f45bf92d471d778ff6d0e0aeb52b1fa2fc5d34e3aa239e16b8b971fd26650512567e12be190f15e73db36f9609ba8101500441db2484b55b1d2d93af7f4932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
20KB

MD5
62b3656502d2f8f50d792ea1c8c41438

SHA1
cb0fd4f8bdfb6e32e86b6d805916dc95bbed7a71

SHA256
4ff8b2f6c2012d486d9388885d7bed23513913f3e50d35bfc34cfc0e6d4c6385

SHA512
a3fb33fe6c2ff563c8324dfeea173ac02d918b38b14adf56403a8fcba33dd21957bd617b4e15d09e1a347a9fe7415789d710505317754873aea6a8b60167eff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
22KB

MD5
1ac27973084a93966f6a90d5b518e258

SHA1
787986ea7a061e18e3d858c919a7692c6d100ed3

SHA256
f8a4c49273653af8dff6bc5e910bdc5a4ca5496c60f0221cfbf3da26df2388f8

SHA512
3bbd2a13f7583890c4730aa4fbe49bd1d280950e28917389177b6eddfdfaee6b1969efa3e4741c6ab21e9f83154540ed80652f3c1c9145fd2fa6a0687b6aa461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
b5fa72bb3aeaf5cf0c6b9c72ab20bfd6

SHA1
ca00971738888f595895ad75220cd7aab08cb7d1

SHA256
3c9e98caf89ac36924c9db6f9656aa67d900a041ec5b8580c2db151518d96b99

SHA512
38aab549087c4a808b89c4de59dd92a1f33deec039dbc3b5850d14f7487c11a42e051794b94157d050394eee676720c7f8fd72df8613c4721295ad0ac62ccf31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
a338a5dd34c8b8f08f4de70077991527

SHA1
67e82cb63ec78af3bede62ec8e0f2cea91eb02c7

SHA256
a5cbcd0aee4643e96f1438768f350bf9b53c762b53c30a82e31934a9871a33f9

SHA512
b52e34e034c10321d3168cbc0d537f042b4721baec962014f9f677bdc48cd5be16b57263d5dbf645b9fc8f6a180852f0cd090ce455ddb2e2513e65662d199349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
28KB

MD5
1e11b2b688bb7a704a366f1a003fea26

SHA1
21be6445859b05c2d69ba324a69b280ff4fa0eb5

SHA256
eed816f1e42ff24e482977e6abf9c3d55b359f288f27c57a99fb4bffbf1c118b

SHA512
33ce11e05dae1b85f0e95fee91f286a73fcbe52cca9ef4ca197a31a19f6a755e31c5a4cdeb168fc3d8f30b8f7d6a68b559ded6033f88edeb7947735e2831cfcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
031f07ac2ee569eef3cccaa870b92b3a

SHA1
696f4178b3e0a3d77b627e5d8d95f009b0207465

SHA256
035c4d8e9fb90f418466f43fe780581f94684fdc81b1a451af3f39a738000a67

SHA512
20e6ef72ac08b263aa2bf6d73d0bd6ce70c1eff1f74c7ad451b7a4deef1f5f4b7ae7438f4fb686c4b107ba206e13c6cbc65aa52492ef4ffc34f4870c3d771e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
8d09a986ef6d5b1c02530f6a0ced647d

SHA1
0af85a0a2958f368764254c1a9d740f7405d2342

SHA256
b6e06ef56496885b6a6759fa6a928ca2b46ca9d6988c590714c56297018ba612

SHA512
e3f64ffc1c15432dda494970c2cbdef175405c433fe98526c6a5e2cffaed17c715343a2b72b3b991dd187ef24f05de8b3d2011be5c21e903c64e29ff63e2ef62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f6067477400297d0e08568835fad8f2d

SHA1
eafc5658703976f55b6a0ee767e812f72018bb38

SHA256
d9cc6635f6fc217b078693bdfa8443e005b89d9033059e40ec55593af65af60c

SHA512
d1a91dc119f8af0297d148f56ae70470bf87f9df69fdbb01298247529262e23b7af19b663fbc69d131909ae645106e7709e8835e2c16f106fe482e3ae5f4b789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
86a2616661f8b30261078cfed9da5c93

SHA1
67dd980084f5bcc7bf3c008be720bf8937b24d7e

SHA256
35c57aeca2e332412f5c62c0d98ebd123901c4cde32b766555a828d49b63cd84

SHA512
761a48fd1fdf7280f0cd0e8832e0613311f3e87df3b09ed86349712604fecd2cbe13abe1927885bf2a0cd0187e9a531133fcf85d2b740db3e23e7a29c43a95c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
631c3ea61c0ccb66ea0d40d0d550ccd1

SHA1
33f9c8b362370c2d4cca6831adebae23b805c78e

SHA256
ecdede5fcbacdee2b431f7c1105f82d0fdd79d61bfa8b771782efd380c0b64f8

SHA512
39c32090a129e333977760df5131cca98c3eb58e7f29eb200f1de2aaf15bbc0e3dd34eead53cb648272cec1f9c0d0055a18e77847cc9d7c3d3c0b22099051717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
bc1d4f70d5b721e77822e0b38ffd6295

SHA1
5622b9f9fa0d13d3fd084d032666a08d3f89c035

SHA256
6089c9a71635477a124632b375c8c190705d5ebe05a3c54b657ac59185e6bd4c

SHA512
9d15d3d5814b681b141ed029c368bafa899b60b168d366aa22e30940d06a719118e14f263406a7787ca04dd61bf203654b8dce9809caac03f190cfec9255c742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a3321359b1142195008fbda66bf263ac

SHA1
a1651ad9d566f7cb47823f9a5649ecffca856407

SHA256
40042940b5be753c3bf595094547cb234c1925dda403000ec6fcd53b1aa84907

SHA512
f81f2a446e3ff693097a4ab07eedd40b4bd8119a149bf83326d528450c5f2679109b1931d3d46121ba4c1ac9dd876889af18f265883d28b25dc799dba3f9b54d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
c612280c4d223b520cab78091717d50f

SHA1
b7fe6de3c0dacc2f8adbee49ca2646c54d5302f9

SHA256
bac02f2b109a61cbd552accb918ea62ab3e8a47be8bcc6ccc43eec06d7835744

SHA512
497284a219385fdd92ba1746c6fea0993acbca3af7387366d8271b3a42777fa501908978706c56eb3e8ffea93b469894f511c5b236ca38769f23f1e93570f5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
31c7b3732550f768a2a90a0aa1cb0be0

SHA1
d05b0604ce8d939658a11532a05894532dd75cb3

SHA256
f28fb4af988e1d11eec028d2a678987f7b332439f2c70278fb13780a5f9488f3

SHA512
d91053ff13d09c9ce58830aa163e23cdca0520e17e1b07af9f89fb4a8d68f5f7fe233f8aaf0c6adff1758e3d1e7b71ed967a70f92d5c9fc1d1f3931f0b51b84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ee6b17dfe311a7c33c7bc751ee88d64d

SHA1
bf498658884ddac420b8c372ebd27ea4d5eac71c

SHA256
cf43b0706be0b16280e76b02a0aa246b8b7edfa25e183a496252c5e60d19df1a

SHA512
036bfe0a5605032f9dd96d8559668d1f1dcbbbd48519f031d207ed80f51931561637945a08196ecc9ff3e411906716fb9fe7e9c057929246f440f03464688119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
abdffa9dfac289aec0337f74bfbe3333

SHA1
ed7755c744a6d1f20e185b238befb772f58d0f50

SHA256
eb53185957cd076f5d1e756e07313154f5aa0b1b4fc596e36becf37b8076186c

SHA512
3d3d9abe1fef8b63365df39e0a69f7ef6c80139ba6a5de757b0efff6d86f03cfe645d557583c6e27ee1f3316b01fc7a844479de54ed7f0bad7c3a6c3df0e7e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
b6a52d4a789335d0c46e0f772128959e

SHA1
7d66a784c29bac3ad5a098c6626635275d14e39c

SHA256
f0c5ad3fa390e42a4f1fbb83034ca22c8bb512fc97ec56ce3ba286bf08bb4fbd

SHA512
55e00ce3719a3e67a811e16212670e3080a0d9fdb5b692ae97597a0d6f5491ae83dbfa5f6871c229e3b1ec60a4c9a9b91c0e0f5239341916c349a4a40414c463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
2d79188b2417fc0d2887eb0337da6b10

SHA1
d00ca038831055542169cc74ab0e5adb222c6cc8

SHA256
1e27cc758bc5955b1c6437120580edc21ca4642f1aae098a22bc1b647f183240

SHA512
bb2c664556319e325422931821271a5c19a372ef724327b4df98d6faf009990b596b9d331935c6d782fd90362528e5e7c1964accef3f25bbad39ca6e7a09dc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
712a102b96b56573c408410ecee274cd

SHA1
d530f5c7d9526619f140c0bdd6d7f2608ee8f64a

SHA256
1fde67838f00de868ebeb6f58c3dff35b74dd89cad6fe67db57bbc77a3959517

SHA512
328e3b4e9fcb67bae7b51e80c614f6ca9fd2cd7e49439ce645c281f77624a2851620f55cbdce319ac0942340d515347128c0f8a5074955d888837553e0d6d43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
08274c8c3c85ca4cff83da0e60b16b93

SHA1
e1ea726d2e8306b91e2cb8cc04294873fd39dee6

SHA256
d9811150f6985369dab5a938beee133f5ed5ff62b8dcbc3c4b15bb7bc7c2329d

SHA512
0504f6c12aae46497bbe1217c560c0b98048ddd6e17084a76342f5452a9840d21670537d0e00197d3518aa29274393b289ba68228201a2b173907ccd7a5c18d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e649.TMP
Filesize
873B

MD5
a826d49817c47fa7035594a8f52d7030

SHA1
5e41472110a55c22bc8b26c785b41622f95a3d93

SHA256
fdcf944a5e747304b8b3bfefe4f3afc61c6e672f4579f5e4015199431f7484d4

SHA512
e0688b16108720033f008c1eb9aa4e2ac05e7def8715835e26cf295f0628b707955934fd9113dc62b90d9a5784d0496a2d533cc8bc18f2ab73ebc131b8cc47b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Filesize
116KB

MD5
a6f0a709dab9a488f7a5b1fa18072bb0

SHA1
572bd355550a02798e82198a80d068b128e26b52

SHA256
84b38935b6b088a4bc9e9e1e5bdc4c442e16bce30ab68787272d0d6c9f54604f

SHA512
e43012666904a8baf740bfd9963045d9fffecbe53f56f0043fdd570ca8ea33f967b32c851b0d5418e0d739f4584cfe24322bd88d7f9c8f274272751a8cb1bb44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
cf805da5e3e6b2e42e3b04dd657cb6de

SHA1
d5b31fb7c04a5fa9715681df8d93a617e3bf4dc3

SHA256
972f78b8ff2d8470e8c4c907744771c45357be4a0e04a120bf1a12960c11cc76

SHA512
4719bb53d1839c3315f43deb3eef75f4205cbb646ca73c25e117ef82ec1f01bb998a833d4284d241987868a1d17ac08025de76570de2d3175c151964b7bca2ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
06bdbd4418a451fa6ec43b6b768d4c39

SHA1
1cf35ccca41bccecd324277b52be61b4051609bb

SHA256
ba82f1b6421bb33b556f26bd0a66f4ff1bcc71f7439e7bcf464730c0d59471a5

SHA512
4039ae2b9b58898f560ddad7222ca481bf4982d780039802f689afc89788dafc624cefaac0652d5daa9ded7997eee24d35f1ed1101dde46a5976782031293e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
f186cc398d470dc5eab40be08fd10108

SHA1
b2f685c8254aabc62e3e304c117cbf61889afa56

SHA256
38afbaad2e7c2a0512136e3bcc9c9a322196271d930d5a5ed94f1d073d00e93b

SHA512
e3b47d20e6db5ec33b4a8272200d172e2a80c4ecfd60fbbb5ea4dd32ce659f32d63fe911ac77953f9b09a1c6e2f2f329803382992e7e554ff68ec0fc96df1bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
6be2012ef8157f11d8aac47ffbee5994

SHA1
76e28ed5d01335c9bf97a7265786e9def66c3354

SHA256
a8e0f85ad432e4a712ee933ab2adae4ada36c7731a577844afc3c5c636e0ebba

SHA512
4c2d1db192b38f08898b4d936bce65fea088353403ede738dbb0e564a765e7c1e5335bbf7f4398805c76fb4efacc8f350cd50f351fbbd1d5308151a25b64062a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
317c7014c85f5c3f72047f01e813bf69

SHA1
037369d7183075397ef1c58e882bfddd228f788e

SHA256
117c3b84dba6997747ee91131dd9eddbac70be29c8bca996ac319ad2b565a01a

SHA512
b8b29dc3b14da2c86457d47dea3cd3446cffde4ceae5b7eb50165bfaa693312d0c5d8aace19125c0c3bd482da4ecb1ae220e266a1ddaf13624ed9d0aa1730e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize
4KB

MD5
a448965aea44ecd039f285191f288dfb

SHA1
96fe8d95c39e569cfdf95d65ec0f3f212aed91a7

SHA256
5f01c490ee4a6dd37453df5eaa143665944ff310dd00fd824d4064e46d31cce4

SHA512
d197a0e46deaedaa3690b97387249b720d573753c9b77cf6b7ed443c7e6a1d8ed0c8235149f406f3bfcc274e357e65b491522f8e81bc6895d402a4b19d26b0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9K21JM10B.439a
Filesize
2KB

MD5
cc0a25bd73ef0243ae9bf21e7cd090cc

SHA1
7e2ad49871bca750f1d20fd34b827c7e287b1ef3

SHA256
824beb81ed4d50a54085ab9711c89217ad5d431e4956fde80256e9775c9b5833

SHA512
cbf7518732710fb006c8c4e0a853eb39898d533c0202ebbed3c87d75f40bb6214c14871ff21bb409b0da1b63050e5fe3d6c953ca0edbb4f722a56525d2e41667

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Malware.bat
Filesize
2KB

MD5
e201d58f2e7e64828ab5f6ada6c16f55

SHA1
3b8cd942176a020e7bee7ecb9dfe2714111c9d9a

SHA256
8b515e5fef4bf198eb37b562ec30923f3a4724e8c4e93119adcc81e2ff6a4fb1

SHA512
38dfa4892b83a49e37bef44f00c2390efd5b2ad7fbb8f5087b938da762208aa9c8de80c9f9a7fe58f41b32b6aaed2176eceb77ccca9b3960cc573a04cf2b9515

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe
Filesize
303KB

MD5
cf6fbbd85d69ed42107a937576028fc9

SHA1
d8f2ca741a8f0beb8e89a68407241c5332759303

SHA256
644455284cd1e2188564dcea09cc0d09448423c9bfdeb9d05a834600d593ec1a

SHA512
562f8004f6d406ed596ff2ad7487f616f1abb98d415d70d87c18f11f364b35a40b959800085966b1680737e6bc7e3793d3b8c60046ea680dc87a673badeab94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe
Filesize
13KB

MD5
6557bd5240397f026e675afb78544a26

SHA1
839e683bf68703d373b6eac246f19386bb181713

SHA256
a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

SHA512
f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll
Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll
Filesize
37KB

MD5
4cf94ffa50fd9bdc0bb93cceaede0629

SHA1
3e30eca720f4c2a708ec53fd7f1ba9e778b4f95f

SHA256
50b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6

SHA512
dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll
Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc
Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\index.html
Filesize
20KB

MD5
08d9ac1e35385587b0c3c8a73ea97234

SHA1
d1db15b5e97152be999339d90630f68ed06a6b78

SHA256
016cadaa9a8494b15efea920a5ea9c02b441e90dbc7c444e73db3b307f93a741

SHA512
8061a5a92f828642ea2fcb319571efa406ed67a75b4d4da1aeb3da96391a72fcde670e3e52efef62d37ddc17f7eca5afa0d35aa02bfd1bcadd8e86240cb802a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\lua\lua.js
Filesize
5KB

MD5
8706d861294e09a1f2f7e63d19e5fcb7

SHA1
fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

SHA256
fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

SHA512
1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.css
Filesize
171KB

MD5
233217455a3ef3604bf4942024b94f98

SHA1
95cd3ce46f4ca65708ec25d59dddbfa3fc44e143

SHA256
2ec118616a1370e7c37342da85834ca1819400c28f83abfcbbb1ef50b51f7701

SHA512
6f4cb7b88673666b7dc1beab3ec2aec4d7d353e6da9f6f14ed2fee8848c7da34ee5060d9eb34ecbb5db71b5b98e3f8582c09ef3efe4f2d9d3135dea87d497455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.js
Filesize
2.0MB

MD5
9399a8eaa741d04b0ae6566a5ebb8106

SHA1
5646a9d35b773d784ad914417ed861c5cba45e31

SHA256
93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

SHA512
d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.js
Filesize
31KB

MD5
74dd2381ddbb5af80ce28aefed3068fc

SHA1
0996dc91842ab20387e08a46f3807a3f77958902

SHA256
fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

SHA512
8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\vs\loader.js
Filesize
27KB

MD5
8a3086f6c6298f986bda09080dd003b1

SHA1
8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

SHA256
0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

SHA512
9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll
Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll
Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll
Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\path.txt
Filesize
33B

MD5
7207978deac3d2df817c0efb6de01f45

SHA1
1b547cb35c2e709dcf4132452cdb5b6ccd66044f

SHA256
14056051c638d943e3f6cd8ae99b7b8b8b4419f6e6193861081e519eeb4dc808

SHA512
d38226a5eb755aafe7e8e3d707b00841aea985bd8dedf20556800f1bb7ac7c807fa195bdd1e21014087f89b319ab278bec922951b7c682e9edd3fbee147834ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll
Filesize
3.9MB

MD5
a4e469b250ddd6b7bf49530074eb58d6

SHA1
b453b13beef7d25bc0675fe68177e5bd2a3b3a22

SHA256
d0123ecdd83962566e620da8f4dbb3a254ed614370d67a07f6c26c3ebbd12c06

SHA512
af21f10ed6ce8b1e98be439f05786dee2dbbe4d5930853ec383f607a9c03b94609d35234bc793422768c1eda342376ca8bb87d6f3a02f30af9fcf37a0cff1bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Filesize
90KB

MD5
d84e7f79f4f0d7074802d2d6e6f3579e

SHA1
494937256229ef022ff05855c3d410ac3e7df721

SHA256
dcfc2b4fa3185df415855ec54395d9c36612f68100d046d8c69659da01f7d227

SHA512
ed7b0ac098c8184b611b83158eaa86619001e74dba079d398b34ac694ce404ba133c2baf43051840132d6a3a089a375550072543b9fab2549d57320d13502260

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\CertificateRevocation\6498.2023.8.1\crl-set
Filesize
21KB

MD5
d246e8dc614619ad838c649e09969503

SHA1
70b7cf937136e17d8cf325b7212f58cba5975b53

SHA256
9dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1

SHA512
736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
79028b57d9e934ffc37167165174c4bc

SHA1
c3a0f546f3adc21f3f70692ecaf75aac7d3fc4f2

SHA256
d5997b240780ea0ab03a2c212b006c4abe1cf4238c1bfc84ac1854ccf067715c

SHA512
9f19d55fc5248f75ea38000d1dd396f777edd806f1c7cf07e573aace846814f4f62ad2c5cb1035ed65fb0b8767caa13a05e52d957fb40b522f3335f35a01a1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
33de3d6266d283747bcdf2ed7348f8f4

SHA1
264c89fac43b4119ec3bb27649bb5fab33b70bcd

SHA256
cd9997fd8a31b7b2b566886e6ebd5a6aa0c7348059c22de3ac2377b9db7878b0

SHA512
ea20cd51bdc6ae9d6f25270de3942596dd88fc5d5f292ab1208d568154bc77ae1c0d8aaa1890844b2166d5537f1ca373ed8a9331fed39a7c97c13360fcd217a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Filesize
1KB

MD5
38a06d51081b2a90ac151dc44d89d5bd

SHA1
925bdeb6a869318263d6abf02757173ff2f58722

SHA256
ed1dc1b3f204baf231e938cdcf62e7356d1a746bfbd59a855e5846b5e018caa9

SHA512
4da708008c1d32dcbdd7882cc34b0c4bd563b913cf340afdca6f5e6f0e38b132e223011bbb4854c614c91b70920ea342e68544e0e17ccf5c496877bbb7e03769

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59bc80.TMP
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Preferences
Filesize
6KB

MD5
fa8fdd84e03fc7528491877a803ddbc3

SHA1
0197819ff541e104286e92c5d40d2bacef0582fa

SHA256
5b6b3889932fc452911483c39109393478359e4ce962badd74442e9a829065ac

SHA512
b1a8a4f7b7efd688c9f70da80773226f15b95119784346377e3bd52ccde1e02ba1bd668a008bbc249b7f04f4e3779c9f49bf652fcbe919688b79f2d46335d5cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\e17eab6c-a283-4289-a797-a9b3ad5536be.tmp
Filesize
6KB

MD5
b6d7b387fbbc9dc9b94e994af57bfd71

SHA1
0631c02a4d68948370104bec8ef7ab6ca5a5ae32

SHA256
fea0a0064a6cb76e8bbb4e8df24caac918882929af8ae26f3fc3a66591b6c66f

SHA512
e3d4fe5587210b0ab04b4d16c5b8aad87146cc8fa92e0e72fed329c311459291aaf7004b76823c344490502e69bbc3ce8cebe9be30839e3f315093fc7e4efeb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
1KB

MD5
609b314f22fc407648f51f36daa33dcc

SHA1
529328ff106ede59266ed668e2392e394133230c

SHA256
002a99c705060f553cd010531ea9106eeb9e2de2ecda25ac6a06ec578a4a523c

SHA512
02eeb3979b516270695c1f1e8aeb5c10ec555c8721110c88b3db5de65e47c9e1f8ed2f64285c3a4402a81eaefbf81f6cfea9fe20df117da0e37bc0cab649bf10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
2KB

MD5
59b7696f72de41a4b20d7a4783f22ca9

SHA1
bb985df1d6a23bbc16a384495338883a770dfc29

SHA256
aaa8f09b47bf7842efcf8b4677243aacb443a72ab8cee3de5301c1fd0b40a065

SHA512
1f09a4ccac36312494c693cf2e9e727b7a3debf21961b4152cfafd078c380a646472a6d42f11d94b929349a9458059c72271f1e0daf6ca2fd81d53a0f049fdef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
3KB

MD5
01788bfd89e94f38a9352a003cd75a6b

SHA1
bae6d2b71a0e8ccbb4984589d9af28dbef47dc80

SHA256
62588194c3cc3d76e17b9ca7cdfb53eb7fa9d75bc471f9851caf6e8eb732b4f3

SHA512
680f3290964fb396c9a5cc48562aa9173af9c274458043e7dae484318fe6af4f57c3d2caec112fc2be1458dfa872b7c85d0a936981333f3501edfe63647d2c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
16KB

MD5
9302c731bd9a8fa81e746c3c1e7398d2

SHA1
43c0c11ade597f86f2b98e848cdad98c08ac2877

SHA256
71e5ba267c42fdcf4062cf6162725b27f7de93b1b8083575b95df83547fe1782

SHA512
a856122983556b8eb53c1414c56cb2376039050b155f3a80aa2d5b231e51da929e76bd4c34658164cb60836a399224bc414127c324b0e155e210e275e89b03dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
18KB

MD5
e1b425578942e6aab870b8b9aea740dd

SHA1
f680c02ba20b028cc901b1d5089e9947c46206d2

SHA256
8d9e355bd25492b2ef242e167c2d93a5d30fc778f97bca7367ae7ba22b13b348

SHA512
79d73d7ff9718d94bd452c8585c877efb8a3733eef050279df05945fdde72857038ec6ac09747ee4b5514abadb1dc723b68f0864730962961758622eab2ceaef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe58a5ef.TMP
Filesize
1KB

MD5
62480730a83aa537bbe839d2f4e250bd

SHA1
0ed9bffe1a2d92550a8f92e5d1f452b0984a4781

SHA256
288bcd4108fe1fb3e3bfbf95fed98e7bba65a9e1f8674d9e66f84594d81041f4

SHA512
071d1e4aad44ec74b3da679b05776935bcf9ead93d455e0d3750569c2e32bf4ed3c5c8bcf258bcbfca6f45d1687bdbad05dc77ba47db79289a7fa6073d8b1cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\crs.pb
Filesize
278KB

MD5
981a9155cad975103b6a26acef33a866

SHA1
1965290a94d172c4def1ac7199736c26dccca33e

SHA256
971393390616fbe53c63865274a40a0b4a8e731c529664275bdc764f09a28e2d

SHA512
2d75ce25cb3a78f69f90fbd23f6e5c9f1a6ed92025f83ce0ab3e0320b64130d586fc2cd960f763e1ab2c82d35ef9650ebd7ff2a42a928a293e0e7428cc669119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\PKIMetadata\13.0.0.0\kp_pinslist.pb
Filesize
11KB

MD5
d43d041e531dc757a69a90cb657ef437

SHA1
09138b427565bc276cfd3ba9f59b0c8bad78e91d

SHA256
9431360a5534ad2f8eddde157cce39704b99da035fcb6d2cca11220700b11ccb

SHA512
476a98122059b9cc19492b7ae557c61381842c8c347f85c686e0a493bfd0e8707ce3491b690e7978b3fb7d7d2a4daa2767e4a590398a50562519bf32e8d12ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\Filtering Rules
Filesize
1.8MB

MD5
a97ea939d1b6d363d1a41c4ab55b9ecb

SHA1
3669e6477eddf2521e874269769b69b042620332

SHA256
97115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f

SHA512
399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\LICENSE
Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Advertising
Filesize
24KB

MD5
131857baba78228374284295fcab3d66

SHA1
180e53e0f9f08745f28207d1f7b394455cf41543

SHA256
b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49

SHA512
c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Analytics
Filesize
4KB

MD5
da298eacf42b8fd3bf54b5030976159b

SHA1
a976f4f5e2d81f80dc0e8a10595190f35e9d324b

SHA256
3abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec

SHA512
5bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptions
Filesize
689B

MD5
108de320dc5348d3b6af1f06a4374407

SHA1
90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b

SHA256
5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53

SHA512
70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Content
Filesize
6KB

MD5
97ea4c3bfaadcb4b176e18f536d8b925

SHA1
61f2eae05bf91d437da7a46a85cbaa13d5a7c7af

SHA256
72ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554

SHA512
5a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Cryptomining
Filesize
1KB

MD5
16779f9f388a6dbefdcaa33c25db08f6

SHA1
d0bfd4788f04251f4f2ac42be198fb717e0046ae

SHA256
75ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639

SHA512
abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Entities
Filesize
68KB

MD5
571c13809cc4efaff6e0b650858b9744

SHA1
83e82a841f1565ad3c395cbc83cb5b0a1e83e132

SHA256
ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b

SHA512
93ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Fingerprinting
Filesize
1KB

MD5
b46196ad79c9ef6ddacc36b790350ca9

SHA1
3df9069231c232fe8571a4772eb832fbbe376c23

SHA256
a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3

SHA512
61d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\LICENSE
Filesize
34KB

MD5
d32239bcb673463ab874e80d47fae504

SHA1
8624bcdae55baeef00cd11d5dfcfa60f68710a02

SHA256
8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903

SHA512
7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Other
Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Social
Filesize
355B

MD5
4c817c4cb035841975c6738aa05742d9

SHA1
1d89da38b339cd9a1aadfc824ed8667018817d4e

SHA256
4358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6

SHA512
fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\TransparentAdvertisers
Filesize
105B

MD5
57d5a3548911886de2f3bd3172e808ed

SHA1
ca932af3b25f245ce931fbc6cf10299e5fbe35a7

SHA256
d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c

SHA512
933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Advertising
Filesize
2KB

MD5
326ddffc1f869b14073a979c0a34d34d

SHA1
df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63

SHA256
d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb

SHA512
3822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Analytics
Filesize
432B

MD5
01f1f3c305218510ccd9aaa42aee9850

SHA1
fbf3e681409d9fb4d36cba1f865b5995de79118c

SHA256
62d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620

SHA512
e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Content
Filesize
48B

MD5
7b0b4a9aafc18cf64f4d4daf365d2d8d

SHA1
e9ed1ecbec6cccfefe00f9718c93db3d66851494

SHA256
0b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43

SHA512
a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Cryptomining
Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Entities
Filesize
42KB

MD5
f446eb7054a356d9e803420c8ec41256

SHA1
98a1606a2ba882106177307ae11ec76cfb1a07ee

SHA256
4dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640

SHA512
3cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Fingerprinting
Filesize
172B

MD5
3852430540e0356d1ba68f31be011533

SHA1
d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff

SHA256
f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054

SHA512
7a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\LICENSE
Filesize
66B

MD5
5b7baf861a48c045d997992424b5877b

SHA1
2b2bd9a13afe49748abf39faf9eb29ed658f066e

SHA256
44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51

SHA512
4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Other
Filesize
91B

MD5
09cedaa60eab8c7d7644d81cf792fe76

SHA1
e68e199c88ea96fcb94b720f300f7098b65d1858

SHA256
c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975

SHA512
564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Social
Filesize
3KB

MD5
318801ce3611c0d25c65b809dd9b5b3c

SHA1
b9d07f2aa9da1d83180dc24459093e20fe9cf1d8

SHA256
2458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03

SHA512
7daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Staging
Filesize
16KB

MD5
39bdf35ac4557a2d2a4efdeeb038723e

SHA1
9703ca8af3432b851cb5054036de32f8ba7b083f

SHA256
04441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae

SHA512
732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\manifest.fingerprint
Filesize
66B

MD5
fc8af1e27127535b4eea55c8c2285865

SHA1
dc9fb2a8fe358f84f4f2749460ef15507e7ecb07

SHA256
c76f988dee6149c0c21f7f657688a7fcaa20b0dc83881efe14d58d9be3f5236b

SHA512
ec847bd27383c37cd67d9204e5dc55256ca0303c0d7696558de650b569ef8f9eb747603180ae6561f884bbe6eb519a23c18fa4a646c43d58799f01744c2b9de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2024.6.20.1\keys.json
Filesize
6KB

MD5
595a80c921652ccf09afd0b196fe3a94

SHA1
e4ae3f8b880e57b64c6e899505a4ad1ec99d6d6b

SHA256
7d9965e3d4c47a32fa6d7b290704f22382b70b80e414ce091eb0b0964dc509a3

SHA512
0dec0a48f2d13100e07a114dd288370a4449cc347162d6febc8b9b1dc66dccacec6bee79b7d42123c12c7500881e31f30cab5ef3f77029493546cf262de583cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\libcurl.dll
Filesize
522KB

MD5
e31f5136d91bad0fcbce053aac798a30

SHA1
ee785d2546aec4803bcae08cdebfd5d168c42337

SHA256
ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

SHA512
a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\vcruntime140.dll
Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\zlib1.dll
Filesize
113KB

MD5
75365924730b0b2c1a6ee9028ef07685

SHA1
a10687c37deb2ce5422140b541a64ac15534250f

SHA256
945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

SHA512
c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

Download Submit
C:\Users\Admin\Downloads\Solara.zip
Filesize
400KB

MD5
20804935c8018d330c47fa7acde89358

SHA1
7e79e69996cf54bf3da5807e37805db03d23f34e

SHA256
65dcaf8699e4d8d8aaa1c177fc49bfe4ff69ad4fd3891d61f68c5239e217cb14

SHA512
7c7cf8a3e6d90376a1a958c57527750c5a04d6d27c90397aac458898a34601a36c5f345afeabaa72f0ece7f3701ac729b68b5bd9f93252552feb4a1f092fc398

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 568755.crdownload
Filesize
8.4MB

MD5
8450908897067c9527740d735897740b

SHA1
71c993302b3174fe4fd712eaf8886a4842778e42

SHA256
f5a04c5d6ddcb4cc3925656919c37a9ca18f20f3623c722dc45499cf1e4de8a8

SHA512
841d6d732db87ca350dd7f4eda273584810dc976f6a368a141de8ea8d87113e8f8ef92c747ee2fa3dc8f906456e2c2c17b122d3f86dea9042c40acb9170848f8

Download Submit
\??\pipe\LOCAL\crashpad_396_GRLMSJBHXKSVUPHA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5200-708-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/5200-709-0x00000000050E0000-0x00000000050EA000-memory.dmp

Filesize
40KB

Download
memory/5200-720-0x0000000005BE0000-0x0000000005BF2000-memory.dmp

Filesize
72KB

Download
memory/5200-2320-0x00007FFF537B0000-0x00007FFF537B1000-memory.dmp

Filesize
4KB

Download
memory/5680-2427-0x00007FFF537B0000-0x00007FFF537B1000-memory.dmp

Filesize
4KB

Download
memory/5884-2189-0x00000173C6DC0000-0x00000173C6E12000-memory.dmp

Filesize
328KB

Download
memory/5896-2284-0x000001B0FE350000-0x000001B0FE358000-memory.dmp

Filesize
32KB

Download
memory/5896-2280-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2185-0x000001B0FB780000-0x000001B0FB79A000-memory.dmp

Filesize
104KB

Download
memory/5896-2255-0x000001B0FE4D0000-0x000001B0FEA0C000-memory.dmp

Filesize
5.2MB

Download
memory/5896-2256-0x000001B0FDF90000-0x000001B0FE04A000-memory.dmp

Filesize
744KB

Download
memory/5896-2258-0x000001B0FE050000-0x000001B0FE102000-memory.dmp

Filesize
712KB

Download
memory/5896-2259-0x000001B0FDEE0000-0x000001B0FDF02000-memory.dmp

Filesize
136KB

Download
memory/5896-2261-0x000001B0FDD70000-0x000001B0FDD7E000-memory.dmp

Filesize
56KB

Download
memory/5896-2266-0x000001B0FE3D0000-0x000001B0FE44E000-memory.dmp

Filesize
504KB

Download
memory/5896-2277-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2279-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2278-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2285-0x000001B0FFE10000-0x000001B0FFE48000-memory.dmp

Filesize
224KB

Download
memory/5896-2286-0x000001B0FE490000-0x000001B0FE49E000-memory.dmp

Filesize
56KB

Download
memory/5896-2605-0x00007FFF49950000-0x00007FFF49974000-memory.dmp

Filesize
144KB

Download
memory/5896-2604-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2797-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2817-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2819-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2829-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2870-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2883-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2926-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-2986-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-3107-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/5896-6492-0x0000000180000000-0x0000000180A5B000-memory.dmp

Filesize
10.4MB

Download
memory/6024-2400-0x00007FFF524E0000-0x00007FFF524E1000-memory.dmp

Filesize
4KB

Download
memory/6024-2401-0x00007FFF524F0000-0x00007FFF524F1000-memory.dmp

Filesize
4KB

Download
memory/6692-6527-0x00007FFF52330000-0x00007FFF52340000-memory.dmp

Filesize
64KB

Download
memory/6692-6541-0x00007FFF518A0000-0x00007FFF518D0000-memory.dmp

Filesize
192KB

Download
memory/6692-6523-0x00007FFF53F70000-0x00007FFF53FA0000-memory.dmp

Filesize
192KB

Download
memory/6692-6521-0x00007FFF53F70000-0x00007FFF53FA0000-memory.dmp

Filesize
192KB

Download
memory/6692-6544-0x00007FFF536F0000-0x00007FFF53700000-memory.dmp

Filesize
64KB

Download
memory/6692-6528-0x00007FFF523C0000-0x00007FFF523D0000-memory.dmp

Filesize
64KB

Download
memory/6692-6547-0x00007FFF537A0000-0x00007FFF537AE000-memory.dmp

Filesize
56KB

Download
memory/6692-6546-0x00007FFF537A0000-0x00007FFF537AE000-memory.dmp

Filesize
56KB

Download
memory/6692-6548-0x00007FFF537A0000-0x00007FFF537AE000-memory.dmp

Filesize
56KB

Download
memory/6692-6549-0x00007FFF537A0000-0x00007FFF537AE000-memory.dmp

Filesize
56KB

Download
memory/6692-6550-0x00007FFF537A0000-0x00007FFF537AE000-memory.dmp

Filesize
56KB

Download
memory/6692-6543-0x00007FFF518A0000-0x00007FFF518D0000-memory.dmp

Filesize
192KB

Download
memory/6692-6525-0x00007FFF54000000-0x00007FFF54005000-memory.dmp

Filesize
20KB

Download
memory/6692-6522-0x00007FFF53F70000-0x00007FFF53FA0000-memory.dmp

Filesize
192KB

Download
memory/6692-6542-0x00007FFF518A0000-0x00007FFF518D0000-memory.dmp

Filesize
192KB

Download
memory/6692-6526-0x00007FFF52330000-0x00007FFF52340000-memory.dmp

Filesize
64KB

Download
memory/6692-6519-0x00007FFF53F20000-0x00007FFF53F30000-memory.dmp

Filesize
64KB

Download
memory/6692-6524-0x00007FFF53F70000-0x00007FFF53FA0000-memory.dmp

Filesize
192KB

Download
memory/6692-6545-0x00007FFF536F0000-0x00007FFF53700000-memory.dmp

Filesize
64KB

Download
memory/6692-6540-0x00007FFF518A0000-0x00007FFF518D0000-memory.dmp

Filesize
192KB

Download
memory/6692-6529-0x00007FFF523C0000-0x00007FFF523D0000-memory.dmp

Filesize
64KB

Download
memory/6692-6530-0x00007FFF523E0000-0x00007FFF523F0000-memory.dmp

Filesize
64KB

Download
memory/6692-6531-0x00007FFF523E0000-0x00007FFF523F0000-memory.dmp

Filesize
64KB

Download
memory/6692-6532-0x00007FFF523E0000-0x00007FFF523F0000-memory.dmp

Filesize
64KB

Download
memory/6692-6533-0x00007FFF523E0000-0x00007FFF523F0000-memory.dmp

Filesize
64KB

Download
memory/6692-6536-0x00007FFF51620000-0x00007FFF51630000-memory.dmp

Filesize
64KB

Download
memory/6692-6537-0x00007FFF51730000-0x00007FFF51740000-memory.dmp

Filesize
64KB

Download
memory/6692-6538-0x00007FFF51730000-0x00007FFF51740000-memory.dmp

Filesize
64KB

Download
memory/6692-6535-0x00007FFF51620000-0x00007FFF51630000-memory.dmp

Filesize
64KB

Download
memory/6692-6539-0x00007FFF518A0000-0x00007FFF518D0000-memory.dmp

Filesize
192KB

Download
memory/6692-6534-0x00007FFF523E0000-0x00007FFF523F0000-memory.dmp

Filesize
64KB

Download
memory/6692-6516-0x00007FFF53E10000-0x00007FFF53E20000-memory.dmp

Filesize
64KB

Download
memory/6692-6518-0x00007FFF53F20000-0x00007FFF53F30000-memory.dmp

Filesize
64KB

Download
memory/6692-6517-0x00007FFF53E10000-0x00007FFF53E20000-memory.dmp

Filesize
64KB

Download
memory/6692-6520-0x00007FFF53F70000-0x00007FFF53FA0000-memory.dmp

Filesize
192KB

Download