257f8251ab61b944b75deafc681030a20b6dd5ae03b8540d8f482a6c291efb96

Resubmissions

06-07-2024 22:02

240706-1x4eratgrl 7

06-07-2024 19:00

240706-xnn2xssgpc 10

Analysis

max time kernel
1800s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProcessLasso.exe
Size

1.8MB
MD5

8fcf7cf04f9b344724759ee830e97ff7
SHA1

7e89c71637362333246cb6f7b30f34a2b7693407
SHA256

449c423ae1a63259989c85176dcc808f767346944eb40eac270ce27795abc1c2
SHA512

3acc527ac9014db980d4c511fd416e32d627f616eb09559a2c3b0cb038a86eee6adf526488053fd09e34ba66fec6109bc534178e4371147d1b23f29803668759
SSDEEP

24576:2XGXE/+1qw6stdHLyjToAdB4/5OH+5yU+yMj0lPj1VFLsPkUdKpVA7KykjgxDyQ3:kB+dHLcToMB4cUDHDVFAPkJVtNRi

Score

9^/10

discovery evasion persistence privilege_escalation themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral10/memory/5332-5105-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5107-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5106-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5108-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5122-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5151-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5184-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5204-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5206-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5332-5212-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5228-5973-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5228-11746-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5616-12932-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral10/memory/5616-13151-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

105 4440 msiexec.exe
107 4440 msiexec.exe

flow	pid	process
105	4440	msiexec.exe
107	4440	msiexec.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

Processes:

flow	ioc
287	raw.githubusercontent.com
276	raw.githubusercontent.com
209	raw.githubusercontent.com
334	raw.githubusercontent.com
369	raw.githubusercontent.com
146	raw.githubusercontent.com
293	raw.githubusercontent.com
302	raw.githubusercontent.com
337	raw.githubusercontent.com
370	raw.githubusercontent.com
95	raw.githubusercontent.com
147	raw.githubusercontent.com
340	raw.githubusercontent.com
372	raw.githubusercontent.com
92	raw.githubusercontent.com

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedgewebview2.exemsedgewebview2.exenode.exeBloxstrap-v2.5.4.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.5.4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

RobloxPlayerBeta.exe

pid process

6152 RobloxPlayerBeta.exe

pid	process
6152	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.execd57e4c171d6e8f5ea8b8f824a6a7316.exeRobloxPlayerBeta.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid	process
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
6152	RobloxPlayerBeta.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exesetup.exemsedgewebview2.exe

description	ioc	process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSVersion.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-explain.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\configuring-npm\npmrc.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\SECURITY.md	msiexec.exe
File created	C:\Program Files\nodejs\node_etw_provider.man	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\copilot_provider_msix\package_metadata	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\using-npm\config.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mute-stream\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\disparity-colors\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\large-numbers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-link.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\man-target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fastest-levenshtein\mod.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\ninja_test.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\vendor\QRCode\QRMode.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ping.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\link-bins.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\signals.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\index.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read-package-json\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\selector.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\help-search.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\dump.js	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Trust Protection Lists\Sigma\Advertising	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-expression-parse\index.js	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Locales\sq.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSUtil.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\pipeline.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\dist\abort-controller.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\Locales\mr.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\graceful-fs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-profile.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-python.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-hook.html	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\learning_tools.dll	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\base.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\cmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\_stream_readable.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3752_2026079866\protocols.json	msedgewebview2.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_verification.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lte.js	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Locales\el.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\package-json.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\blob.js	msiexec.exe

Drops file in Windows directory 21 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI48A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DEB.tmp	msiexec.exe
File created	C:\Windows\Installer\e6b177e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A60.tmp	msiexec.exe
File created	C:\Windows\Installer\e6b1782.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B95.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2185.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2753.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2773.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e6b177e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F90.tmp	msiexec.exe

Executes dropped EXE 38 IoCs

Processes:

vc_redist.x64.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exenode.exevc_redist.x64.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exeBloxstrap-v2.5.4.exenode.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.87.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exenode.exevc_redist.x64.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exenode.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exe

pid	process
1660	vc_redist.x64.exe
3192	vc_redist.x64.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5496	node.exe
5684	vc_redist.x64.exe
5724	vc_redist.x64.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5200	Bloxstrap-v2.5.4.exe
5748	node.exe
8876	MicrosoftEdgeWebview2Setup.exe
5608	MicrosoftEdgeUpdate.exe
5996	MicrosoftEdgeUpdate.exe
4700	MicrosoftEdgeUpdate.exe
5708	MicrosoftEdgeUpdateComRegisterShell64.exe
2712	MicrosoftEdgeUpdateComRegisterShell64.exe
5904	MicrosoftEdgeUpdateComRegisterShell64.exe
1976	MicrosoftEdgeUpdate.exe
5916	MicrosoftEdgeUpdate.exe
5956	MicrosoftEdgeUpdate.exe
2264	MicrosoftEdgeUpdate.exe
7844	MicrosoftEdge_X64_126.0.2592.87.exe
9296	setup.exe
9324	setup.exe
3308	MicrosoftEdgeUpdate.exe
6152	RobloxPlayerBeta.exe
8948	node.exe
9120	vc_redist.x64.exe
9148	vc_redist.x64.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5000	node.exe
3752	msedgewebview2.exe
2776	msedgewebview2.exe
3776	msedgewebview2.exe
4376	msedgewebview2.exe
4468	msedgewebview2.exe
5332	msedgewebview2.exe
6192	msedgewebview2.exe
5956	msedgewebview2.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exevc_redist.x64.execd57e4c171d6e8f5ea8b8f824a6a7316.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exe

pid	process
772	MsiExec.exe
772	MsiExec.exe
392	MsiExec.exe
392	MsiExec.exe
392	MsiExec.exe
392	MsiExec.exe
392	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
772	MsiExec.exe
3192	vc_redist.x64.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5332	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5724	vc_redist.x64.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5608	MicrosoftEdgeUpdate.exe
5996	MicrosoftEdgeUpdate.exe
4700	MicrosoftEdgeUpdate.exe
5708	MicrosoftEdgeUpdateComRegisterShell64.exe
4700	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdateComRegisterShell64.exe
4700	MicrosoftEdgeUpdate.exe
5904	MicrosoftEdgeUpdateComRegisterShell64.exe
4700	MicrosoftEdgeUpdate.exe
1976	MicrosoftEdgeUpdate.exe
5916	MicrosoftEdgeUpdate.exe
5956	MicrosoftEdgeUpdate.exe
5956	MicrosoftEdgeUpdate.exe
5916	MicrosoftEdgeUpdate.exe
2264	MicrosoftEdgeUpdate.exe
3308	MicrosoftEdgeUpdate.exe
6152	RobloxPlayerBeta.exe
9148	vc_redist.x64.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
5616	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3752	msedgewebview2.exe
2776	msedgewebview2.exe
3752	msedgewebview2.exe
3752	msedgewebview2.exe
3752	msedgewebview2.exe
3776	msedgewebview2.exe
3776	msedgewebview2.exe
4376	msedgewebview2.exe
4468	msedgewebview2.exe
4376	msedgewebview2.exe
4468	msedgewebview2.exe
3776	msedgewebview2.exe
3776	msedgewebview2.exe
3776	msedgewebview2.exe
3776	msedgewebview2.exe
5332	msedgewebview2.exe
5332	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exeProcessLasso.exeprocessgovernor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedgewebview2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

MicrosoftEdgeUpdate.exemsiexec.exemsedgewebview2.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133647678683862725"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exemsedge.exeBloxstrap-v2.5.4.exeMicrosoftEdgeUpdateComRegisterShell64.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1"	Bloxstrap-v2.5.4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 2 IoCs

Processes:

msedge.exeBloxstrap-v2.5.4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 243558.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:SmartScreen:$DATA	Bloxstrap-v2.5.4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ProcessLasso.exemsedge.exemsedge.exeprocessgovernor.exeidentity_helper.exe

pid	process
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3920	msedge.exe
3920	msedge.exe
4908	msedge.exe
4908	msedge.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4932	identity_helper.exe
4932	identity_helper.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4348	processgovernor.exe
4348	processgovernor.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

processgovernor.exemsedge.exe

pid process

4348 processgovernor.exe
4908 msedge.exe

pid	process
4348	processgovernor.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

msedge.exemsedgewebview2.exe

pid	process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
3752	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ProcessLasso.exeprocessgovernor.exeSolaraBootstrapper.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	3764	ProcessLasso.exe
Token: SeDebugPrivilege	3764	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	3764	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	3764	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	3764	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	3764	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	3764	ProcessLasso.exe
Token: SeBackupPrivilege	3764	ProcessLasso.exe
Token: SeRestorePrivilege	3764	ProcessLasso.exe
Token: SeAssignPrimaryTokenPrivilege	4348	processgovernor.exe
Token: SeDebugPrivilege	4348	processgovernor.exe
Token: SeChangeNotifyPrivilege	4348	processgovernor.exe
Token: SeIncBasePriorityPrivilege	4348	processgovernor.exe
Token: SeIncreaseQuotaPrivilege	4348	processgovernor.exe
Token: SeProfSingleProcessPrivilege	4348	processgovernor.exe
Token: SeCreateGlobalPrivilege	4348	processgovernor.exe
Token: SeBackupPrivilege	4348	processgovernor.exe
Token: SeRestorePrivilege	4348	processgovernor.exe
Token: SeDebugPrivilege	2320	SolaraBootstrapper.exe
Token: SeShutdownPrivilege	3716	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3716	msiexec.exe
Token: SeSecurityPrivilege	4440	msiexec.exe
Token: SeCreateTokenPrivilege	3716	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3716	msiexec.exe
Token: SeLockMemoryPrivilege	3716	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3716	msiexec.exe
Token: SeMachineAccountPrivilege	3716	msiexec.exe
Token: SeTcbPrivilege	3716	msiexec.exe
Token: SeSecurityPrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe
Token: SeLoadDriverPrivilege	3716	msiexec.exe
Token: SeSystemProfilePrivilege	3716	msiexec.exe
Token: SeSystemtimePrivilege	3716	msiexec.exe
Token: SeProfSingleProcessPrivilege	3716	msiexec.exe
Token: SeIncBasePriorityPrivilege	3716	msiexec.exe
Token: SeCreatePagefilePrivilege	3716	msiexec.exe
Token: SeCreatePermanentPrivilege	3716	msiexec.exe
Token: SeBackupPrivilege	3716	msiexec.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeShutdownPrivilege	3716	msiexec.exe
Token: SeDebugPrivilege	3716	msiexec.exe
Token: SeAuditPrivilege	3716	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3716	msiexec.exe
Token: SeChangeNotifyPrivilege	3716	msiexec.exe
Token: SeRemoteShutdownPrivilege	3716	msiexec.exe
Token: SeUndockPrivilege	3716	msiexec.exe
Token: SeSyncAgentPrivilege	3716	msiexec.exe
Token: SeEnableDelegationPrivilege	3716	msiexec.exe
Token: SeManageVolumePrivilege	3716	msiexec.exe
Token: SeImpersonatePrivilege	3716	msiexec.exe
Token: SeCreateGlobalPrivilege	3716	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

ProcessLasso.exemsedge.exe

pid	process
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

ProcessLasso.exemsedge.exe

pid	process
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe
3764	ProcessLasso.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

vc_redist.x64.exevc_redist.x64.exenode.exevc_redist.x64.exevc_redist.x64.exenode.exenode.exevc_redist.x64.exevc_redist.x64.exenode.exe

pid	process
1660	vc_redist.x64.exe
3192	vc_redist.x64.exe
5496	node.exe
5684	vc_redist.x64.exe
5724	vc_redist.x64.exe
5748	node.exe
8948	node.exe
9120	vc_redist.x64.exe
9148	vc_redist.x64.exe
5000	node.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

RobloxPlayerBeta.exe

pid process

6152 RobloxPlayerBeta.exe

pid	process
6152	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ProcessLasso.exemsedge.exe

description	pid	process	target process
PID 3764 wrote to memory of 4348	3764	ProcessLasso.exe	processgovernor.exe
PID 3764 wrote to memory of 4348	3764	ProcessLasso.exe	processgovernor.exe
PID 4908 wrote to memory of 972	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 972	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4492	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3920	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3920	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4884	4908	msedge.exe	msedge.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

msedgewebview2.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3764

C:\Users\Admin\AppData\Local\Temp\processgovernor.exe
"C:\Users\Admin\AppData\Local\Temp\processgovernor.exe"
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe7ed46f8,0x7fffe7ed4708,0x7fffe7ed4718
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
2⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
2⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1380 /prefetch:8
2⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
2⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5716 /prefetch:8
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6284 /prefetch:8
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
2⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
2⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6880 /prefetch:8
2⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6664 /prefetch:8
2⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
2⤵
PID:3040

C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe
"C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
PID:5200

C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe" /silent /install
3⤵
- Executes dropped EXE
PID:8876

C:\Program Files (x86)\Microsoft\Temp\EUF4DF.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUF4DF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
PID:5608

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5996

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4700

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5708

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2712

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5904

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzY3Rjc0M0UtMUUxRi00RTNDLUJDQjktRkU5RDUxRTZDNzJDfSIgdXNlcmlkPSJ7M0YzNjhDMEMtNjRENi00QUJDLTk1MUQtQTFFNkJDRTAzOUY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4OTNDMDNGMS1GNTAzLTQ0QTgtOUEyMC04QTRDODY3REI5M0V9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny40MSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwMDg4OTEzNjY2IiBpbnN0YWxsX3RpbWVfbXM9IjkwNSIvPjwvYXBwPjwvcmVxdWVzdD4
5⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
PID:1976

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{367F743E-1E1F-4E3C-BCB9-FE9D51E6C72C}" /silent
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5916

C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" --app -channel production
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
PID:6152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:7432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
2⤵
PID:7412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6510081518465015745,6889165530756699016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:7248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4624

C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\SysWOW64\msiexec.exe
"msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\Temp\{BB35FD62-699C-4E23-AB27-0AED9DCE7196}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{BB35FD62-699C-4E23-AB27-0AED9DCE7196}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=568 /install /quiet /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3192

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:5332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 8C6AB757B20ED6975E7821C549C995D3
2⤵
- Loads dropped DLL
PID:772

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B58C4446993BF4092B0B8BB9F2A696D0
2⤵
- Loads dropped DLL
PID:392

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 767DDB0F8D66A9D7ECA61EECB08BBEA8 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:3096

C:\Windows\SysWOW64\wevtutil.exe
"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
3⤵
PID:4588

C:\Windows\System32\wevtutil.exe
"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
4⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:4344

C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe"
1⤵
PID:3524

C:\Program Files\nodejs\node.exe
"node" -v
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5684

C:\Windows\Temp\{A364DF02-0759-4824-9D1D-97FB2D99589A}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{A364DF02-0759-4824-9D1D-97FB2D99589A}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=672 /install /quiet /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pizzaboxer/bloxstrap/releases/download/v2.5.4/Bloxstrap-v2.5.4.exe
2⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe7ed46f8,0x7fffe7ed4708,0x7fffe7ed4718
3⤵
PID:6024

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:5228

C:\Program Files\nodejs\node.exe
node "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\index.js"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:5956

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzY3Rjc0M0UtMUUxRi00RTNDLUJDQjktRkU5RDUxRTZDNzJDfSIgdXNlcmlkPSJ7M0YzNjhDMEMtNjRENi00QUJDLTk1MUQtQTFFNkJDRTAzOUY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFOTVDQ0U2RC1BNkY0LTQwMDItQTI3RS0wN0MxM0M3MUQ1MEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwMDkzNjYzNjkzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
PID:2264

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\MicrosoftEdge_X64_126.0.2592.87.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\MicrosoftEdge_X64_126.0.2592.87.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
2⤵
- Executes dropped EXE
PID:7844

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\EDGEMITMP_3DEC4.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\EDGEMITMP_3DEC4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\MicrosoftEdge_X64_126.0.2592.87.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:9296

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\EDGEMITMP_3DEC4.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\EDGEMITMP_3DEC4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F0627B31-9B4D-44CD-8C4B-1565B7F89D7D}\EDGEMITMP_3DEC4.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.87 --initial-client-data=0x22c,0x230,0x234,0x214,0x238,0x7ff77921aa40,0x7ff77921aa4c,0x7ff77921aa58
4⤵
- Executes dropped EXE
PID:9324

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzY3Rjc0M0UtMUUxRi00RTNDLUJDQjktRkU5RDUxRTZDNzJDfSIgdXNlcmlkPSJ7M0YzNjhDMEMtNjRENi00QUJDLTk1MUQtQTFFNkJDRTAzOUY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCMjk2QkREQy1CQjgyLTQyRjMtOUIwOC1COTQxOERFRTgzMTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI2LjAuMjU5Mi44NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjAxMDMzMjM2NjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDEwMzQ4MzU0MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwMzE0MjYzNDU5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iZGU2NGY0Ny04ZmEzLTRmNmMtOGJjZS1kMjc0MjQxYjZhMmI_UDE9MTcyMDg5ODkxNCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GTCUyYjJjT3NXZU1vYXZoVmFjQ1k0dU42NTFGdjZjOHk1diUyZjMlMmZlRGp6JTJiMktURTc4czRmbFV3V2NaMFFJbkJpblRZeGRqcjI3Nm9CeXlJS3klMmZHMFB5NUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzMwNDEyMjQiIHRvdGFsPSIxNzMwNDEyMjQiIGRvd25sb2FkX3RpbWVfbXM9IjE0NzEwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjAzMTQzODM2MTEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDMyOTAyMzQxNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjA3OTE4NjM0NzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MTAiIGRvd25sb2FkX3RpbWVfbXM9IjIxMDc0IiBkb3dubG9hZGVkPSIxNzMwNDEyMjQiIHRvdGFsPSIxNzMwNDEyMjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ2MjgzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb42e4f28hbe4fh492fh8fb5ha42fb77aadce
1⤵
PID:10016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x120,0x124,0x48,0x128,0x7fffe7ed46f8,0x7fffe7ed4708,0x7fffe7ed4718
2⤵
PID:10036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7703856339452478580,4852035626181014659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
2⤵
PID:10228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7703856339452478580,4852035626181014659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
PID:7924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:868

C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\SolaraB2\SolaraB2\Solara\SolaraBootstrapper.exe"
1⤵
PID:8872

C:\Program Files\nodejs\node.exe
"node" -v
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8948

C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:9120

C:\Windows\Temp\{4EB67AE1-E030-4865-8EDD-D9620713FA7D}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{4EB67AE1-E030-4865-8EDD-D9620713FA7D}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=708 /install /quiet /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:9148

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:5616

C:\Program Files\nodejs\node.exe
node "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\index.js"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5616.5900.4519421027839606793
3⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:3752

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.87 --initial-client-data=0x174,0x178,0x17c,0x90,0x184,0x7fffd1f90148,0x7fffd1f90154,0x7fffd1f90160
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3776

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1952,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4376

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2172,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4468

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3528,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5332

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4864,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
4⤵
- Executes dropped EXE
PID:6192

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.87\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=5036,i,752637197804534151,447767067073100490,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
4⤵
- Executes dropped EXE
PID:5956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e6b1781.rbs

Filesize
1.0MB

MD5
46af2bcbfc3bdc1292d3871d650652a1

SHA1
e6ed4cc951424f5ac43b2899b6c166290e02a2da

SHA256
b253d3045e87d246e1031cd457ab4efa7fdf6254edf92ec06ae2b8756a089984

SHA512
46ca94c92e00b0b8bb413e9379da87f99233c9f152e8272321d44f9c2a9013757d9315f07a3039c851ed6bea9b27f56907482fa362e04b3ad9395edb81835e04

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.87\Installer\setup.exe

Filesize
6.5MB

MD5
44bab1ba8bbc80a6f11a59a921ade1fe

SHA1
71292aa421fc9cefd9eeade06fc5af52f71e8dc2

SHA256
a03c11b73af7ccf83f2a4bc1995f9083f8415174d1e8f6d6465e9192aabb542a

SHA512
fcb6f75c3367b91da92b3d866ae6b85428d8c2ef13499344e80ddd3bb30f47d1243120aa41eba519756bcb6ff5f9708e7fe7281265c4c32766231765aa8104e2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
be9591e6fd5cc329e08a9f2494ee7abb

SHA1
7f1aa412157fa0a79a9d7e1531cd8e6e7fa4de36

SHA256
2f90a4a819fe09060bcd0985f76ddafa545a6f5788f1e53aa56310f8495bb1bb

SHA512
666c06b70b8a1aa24bbfa84c382eb17ded1c2e8d91adaec7ab621481300adffbb580bb6aa1054ad63f95d6594802d4a27f096b0a338d8ceb2c4349fdf15b0951

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3752_2026079866\manifest.fingerprint

Filesize
66B

MD5
0c9218609241dbaa26eba66d5aaf08ab

SHA1
31f1437c07241e5f075268212c11a566ceb514ec

SHA256
52493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b

SHA512
5d25a1fb8d9e902647673975f13d7ca11e1f00f3c19449973d6b466d333198768e777b8cae5becef5c66c9a0c0ef320a65116b5070c66e3b9844461bb0ffa47f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3752_2026079866\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3752_707767020\manifest.json

Filesize
43B

MD5
55cf847309615667a4165f3796268958

SHA1
097d7d123cb0658c6de187e42c653ad7d5bbf527

SHA256
54f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877

SHA512
53c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
2a6686d512ee9ba8b75e0bce9a794770

SHA1
465e00320c74d4481a5e7e7242aaeb60d02e2fab

SHA256
5afa5bcab0d66f0dc65ccad359650730ace53dff1d891cd33a9f54aa43d34419

SHA512
ff44d6f3e7be06c98077a00854edb0ca122fc5c98c976f86787c7b003d224f62c1079412e7c5cdb36c2a6df0825dd17ccbffe44eb264fa63e3d1e44654af74b2

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
198KB

MD5
70e49ccbdb09106e6646e8ecef2455c8

SHA1
3eb5364d3883b1775c78291bfc65ab8b1af2c9e9

SHA256
af1aa72c45419adba4876f1dd02a28929fee3d94d4f3d035d9a06ac70b9096b9

SHA512
787b47950bbda5ea2c50e9737b099a773b3f5a687af9257b54b226147b1b79ddf0cb040a397b58adc473b6d427399ef765c8616adb7ac32dde296553ecef6e46

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json

Filesize
121B

MD5
4404bed49a6c0867a0d0b6b5e118407b

SHA1
37527ae8967510aa696dc31f9fac02c9c5c8b392

SHA256
9035075800218227689b77309cdf3823bb81fb1e423f0e6c8576dd22c8c83d21

SHA512
b66053497d26eb08503baf0b5fe13c524cb98f7cdea86c84d80aa801b8eeb9dd9346a7af67872e73fa2778b1b36f6f1ca70f1cbd2fc7ad82e74aed2d1f5fd4cb

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png

Filesize
20KB

MD5
4f8f43c5d5c2895640ed4fdca39737d5

SHA1
fb46095bdfcab74d61e1171632c25f783ef495fa

SHA256
fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

SHA512
7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\[email protected]

Filesize
71KB

MD5
3fec0191b36b9d9448a73ff1a937a1f7

SHA1
bee7d28204245e3088689ac08da18b43eae531ba

SHA256
1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

SHA512
a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png

Filesize
247B

MD5
81ce54dfd6605840a1bd2f9b0b3f807d

SHA1
4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

SHA256
0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

SHA512
57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-hans.json

Filesize
2KB

MD5
fb6605abd624d1923aef5f2122b5ae58

SHA1
6e98c0a31fa39c781df33628b55568e095be7d71

SHA256
7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

SHA512
97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-tw.json

Filesize
2KB

MD5
702c9879f2289959ceaa91d3045f28aa

SHA1
775072f139acc8eafb219af355f60b2f57094276

SHA256
a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

SHA512
815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\sounds\ouch.ogg

Filesize
6KB

MD5
9404c52d6f311da02d65d4320bfebb59

SHA1
0b5b5c2e7c631894953d5828fec06bdf6adba55f

SHA256
c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317

SHA512
22aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\Cursors\KeyboardMouse\IBeamCursor.png

Filesize
292B

MD5
464c4983fa06ad6cf235ec6793de5f83

SHA1
8afeb666c8aee7290ab587a2bfb29fc3551669e8

SHA256
99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

SHA512
f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioToolbox\Clear.png

Filesize
538B

MD5
fa8eaf9266c707e151bb20281b3c0988

SHA1
3ca097ad4cd097745d33d386cc2d626ece8cb969

SHA256
8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

SHA512
e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png

Filesize
130B

MD5
521fb651c83453bf42d7432896040e5e

SHA1
8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

SHA256
630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

SHA512
8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\TerrainTools\checkbox_square.png

Filesize
985B

MD5
2cb16991a26dc803f43963bdc7571e3f

SHA1
12ad66a51b60eeaed199bc521800f7c763a3bc7b

SHA256
c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

SHA512
4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick1.png

Filesize
641B

MD5
2cbe38df9a03133ddf11a940c09b49cd

SHA1
6fb5c191ed8ce9495c66b90aaf53662bfe199846

SHA256
0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

SHA512
dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
e8c88cf5c5ef7ae5ddee2d0e8376b32f

SHA1
77f2a5b11436d247d1acc3bac8edffc99c496839

SHA256
9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

SHA512
32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
499333dae156bb4c9e9309a4842be4c8

SHA1
d18c4c36bdb297208589dc93715560acaf761c3a

SHA256
d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

SHA512
91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick2.png

Filesize
738B

MD5
a402aacac8be906bcc07d50669d32061

SHA1
9d75c1afbe9fc482983978cae4c553aa32625640

SHA256
62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

SHA512
d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
83e9b7823c0a5c4c67a603a734233dec

SHA1
2eaf04ad636bf71afdf73b004d17d366ac6d333e

SHA256
3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

SHA512
e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

Download Submit
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

Filesize
1KB

MD5
55b64987636b9740ab1de7debd1f0b2f

SHA1
96f67222ce7d7748ec968e95a2f6495860f9d9c9

SHA256
f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

SHA512
73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e81c757cdb64c4fd5c91e6ade1a16308

SHA1
19dc7ff5e8551a2b08874131d962b697bb84ad9b

SHA256
82141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3

SHA512
ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2e57ec8bd99545e47a55d581964d0549

SHA1
bd7055ea7df7696298a94dedfc91136e3b530db8

SHA256
a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c

SHA512
6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cd936e9-04ed-469d-8d31-78afa284cafd.tmp

Filesize
5KB

MD5
03530091124569f08c7e7b3d66c93c60

SHA1
abafaf257067e43fcd2e120a4d2539cbc25a55a1

SHA256
c4bedafc42ab08224310048c622321faa043434216c8ee4c05e158681d08e982

SHA512
f38f382ca45d002709140672911c39847e186d4f9d38418ead5f268785568a2095712491255b3a8f3146b7d8c27a0443c61547118db8251f3746ea9739109dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
a8037f85d61915ce1297fccc2d097a16

SHA1
3daaa030ad0d48b1fc9290c85acc63c37064f299

SHA256
72b67900ab3e8f6ae9370ca4123a6ad1e1ed9230a18ce7e921bee2ac0a23876e

SHA512
748d8722a54a936b0dafa32389b50418df1ae4e161af791714c0cc27c1ab9b27bce158e4c9c525aa4fa1ad9f002510a86a98578352d9cd5e2d1a319c6fa27168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1c8eefbeef8d11cb78a08d0abf35407f

SHA1
2f2622466418cc5e11932600889756ee46aec9db

SHA256
3825b1b3ea4fe69aa3c1e7028b4b23ca28c5960b2cb05aec5745d0c8f5c02735

SHA512
af490f2ba7ae64fba64a18b5a2aac557e7b1b09e7f0947e5306630332864d9d80230bfa3ea37e307b7ecece3250d7fa46335f577847b7b58d34f8bbdbd795e49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c61db5f4c3640ed38de244f02c6da0bc

SHA1
e3fe7a0d2efefeb2b3e55b38b5b467e958313fd2

SHA256
3145aa8a17f5cd722fa782dd2a79e9a4020df4edf64489de477ef96a43b02e25

SHA512
bba5e4e58b7e11e5404321e40ce501e95c2b0b27f605b7343e15453e2c877ae2e76229cf8b1e34fc8b4cb850e590986ee3fd4ded15c41606348e73fc66c1f268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
32ee65ebebb44fe88e5dd7c5af5ef7ca

SHA1
3632cbea90e4d0b0256627f06cfd2c2e43c049f3

SHA256
069ad995f0f13975723fd8bdb721e4b57b4ca801593a57231dfa5c519b3d3ff2

SHA512
03ff668595e2af16a5053ea2b8b275463996587fef5785b53697d07ba56929d48a6b564a597630b4b6d57de046e381b41ab4abb579402bc7c134ae6740aab58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
4cd93ff4854d444e0dc2b389fef55325

SHA1
2b34a018cc11f1e56995289a2c0745f319237288

SHA256
0cce451b5330c3af351b54f22585280a42a53e38dba637edaeb8ca9fbdc7cc37

SHA512
83d5e6036e5a9b704df6b3a0c55858bf7706981520035b2ed9ee23c8a64574e9e4b32bc2d63c352782d5d77b7afbd19552030b22caf32566e9000563d109e85f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
118db28492d4294882f6c4f727d3affc

SHA1
74dc27c68ccfbc10ddf8028cdfde309bbde79379

SHA256
da86ede150f90fbe61cfbb822fe260a7349c207355bc3c652f360965b8d4c223

SHA512
fbcc1952630f9f7fbbd597d618dd3783cc043eaff6bbfc364440b54c5adcce814b45ea9fe190b908a9fff8297222a1500edd4ffee727bd617c533a4ef8749242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
09b5769920a1b44b946760098478e523

SHA1
d7be333c8405b1975131bcd7b95b25be5245d400

SHA256
61e3b158067fdb27ee6cfee54044a070d76c5b3ce4186e70981609d1eecd7bfc

SHA512
cc47eb57e25e6eac850b7f305bdffb33b452a8977e1a06871d8a70044bbd115f13a67926b69034d9937d842b02f52e9d6ad8930e1563d12e1a836729b99b9969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ccfd59fdc24ed0184561dd66197a9ea5

SHA1
570f30e2d72a76198c7e223bca74de7bb3fb7319

SHA256
e41d2630197b4808ed069c9eea98b59b100294d50a599811c67317965fe55fb7

SHA512
77db0ca4556292ee5875c639f15281fbd69afcfb7d45881dd5e0c02ad191dd00e5fe7835ecaf8e7d26ca2779a9685804d170d6a8db2200c78343bb60c4746b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e1db7d2143bce1f2a3a9855f0d15c7c

SHA1
143cee146faeae86978d9583b7326667bf0ee985

SHA256
d9d5d62aa9c85f49b1be39f7a6fa781f2269584bc26abea8633e0a10f9ecc072

SHA512
dbfef420adea225fc6034da7ae9879d03b29fa5cfa40e4811ef4e482708fd0293d45024582324e61891e385dd2187b77e4da34e93dc550a368c267aff73fea93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d10185ca0f6465076d299ccbfd850d1a

SHA1
bb0781a85fa3845329f1b7c9be97889eafcf4b40

SHA256
96cc60d8a2a4574484f30239d8670fd860d6b79b6138669f409026b6b70b9a5e

SHA512
ae47e3ab064815c7a38e3284fd4b886ec63674fb9cb6c85c0323c35f0ce2eeb1249e6863b309b95a6800d5acb0103728c604ca4305c34e793eb10aa0e24879c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
75a45a5495930a1934f81b3a30d15aa6

SHA1
4b6a5a78c1b13a1cb674cc2cee8cd91755f5e394

SHA256
54f3864530c3ccdaf23f942e7fb36e8fbcd8220b91830e04db15dcd13d5d25a1

SHA512
0180173f44b53df418db5c169e0288aaa91c5062a4e3fc720a2b539cf484c5a812bcc6d1badbca2fec6836652c8814de86d606f41efe6ddbeebf57d4b45d8ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
020f733a015a764589539c5d38924045

SHA1
537b5c1bf9d2f94e07edca42a88b2eb1ceff07f6

SHA256
4e80947653696b44f70bab8d5247c3baa46574c4d0ce2803cf0c83a60bb0ea9c

SHA512
a78cd64077e10a0145cdf609d822639f40e99fa539b85b422e03b8d075e5b8d98d457825d86800531067a2611867f3ab861d484570db9b7b8d89d60765f6b435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ec175110da4f6648876081c91e48591

SHA1
c6208b71204df8fe16fb06aba3c0a4139c96dd28

SHA256
ec417087a497896a4bb37d559045cbb210133730cd881079f837ae28cdb2047b

SHA512
a0f14078cd79472bc47cf34d872fdbafee4ffa81b9ea8d643a0da3c4eedee7baad522470ebeb9861c57942e5f494e941b19b04f5798996a7a69bb4212cd0acf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
075e52554336af57b0bcf2a76d1e053e

SHA1
055d65f5732d3c44251d449d7219be437703d7d7

SHA256
737e2b84a4a172c6b4be528559be444c5c4006912e10da9cfcaa56fa7e800e80

SHA512
33dc1551660e74b4f42520d3059f7418c19b1836bc32994e1677952a900992c58e51351294075c98facf8b7318912dd725f13a54423ab3e5ae78af25fb746016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
72d02ef176cda8d16fe859753a3bd4b4

SHA1
540ae582c811548bb4eb8144a3ea419958a9f999

SHA256
b243fc0fd75fe88d909561ea040693d8f88eddc18fccfc9d789711e2d5768222

SHA512
4adb923566d06ced2a924c7e5261e1c1627350a300dc0907897be4e0e03feadf1cb362ed6c86bd722cf2d435f26836aec86e1b67e5bdfc426c0a72227f3b63ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ba294fda26919e78d157f7e30e35a49

SHA1
ca1292166aa409e5ac0644234164d8202a4253e4

SHA256
21aeb2802d1ad5b3a1c0f486decec1e959be8910124dde7c11c180b5fe0e49a2

SHA512
fce5149e197197fbc435ddc4556b1bfc0461d3d5d5e20ce91a1b30cd500ebc9ee45e83f6c260f7a9883657a616441f9c04450538827a848191658200e8f022b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dff9f224f7eddb69b4aad43b311a1c7

SHA1
3c912c349f2b8bc5ef42bca50df6a00f4acdce9d

SHA256
9180ba8b3e0f89a3f9cb9a924444fc878aac60d788f9c4e87a7a07bf6657df9f

SHA512
01715b6b03ace786b78638b98be5fc28e5507cd9186517b8a76e47190b7b744d34f3b20cac5699ae32c7a1e503c7c17da5a6fbbbc664c0e87ac0550263ca8cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f8a043a118456e891f5e746c7214f6b0

SHA1
03761a02530377ec7fa21bfcf5d2dad8fcb3d5e7

SHA256
60f895d05f5d8e6421610ff8faf132bd2a4cdb126d215956068ab931de6326d3

SHA512
f57a0b23b9dd52a76b1a0a2d51739ab1ba244d6202d56bd5f9110811b46f13897c21df697ed73655cd54cb5ac9d4a5fdde2cf0fd57c4690fa53c7110150942e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d1bd43807583a59eefcb8c89a5caeed

SHA1
92c24be80dd20898361d58f870c39758e5cf2493

SHA256
7cc84067a5f5921143f4befcdd8e7c8c01eb4d1712577d5f14da187e941eb4c0

SHA512
a534df6ff9e38b7fe38b500bb8b9f62ea56825f2590651b7c1f3062b3deae191123f0134bd6f764d9442f7af1e1b01908d6a7ce0c76a7a877235e61cc393dc72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec1b39c10bd3e63aebd548ed0b9f7085

SHA1
6f6d388075856d6902ede47c51574e9c8c3d8fe8

SHA256
92ef8b4207100d5ef994b5d4d29c199950a23a032807ed6cb890e5d92c38fceb

SHA512
6a34069738922662cf19a70275d9040eed96706171851c94ac1662c864a062cb69a53f01eeb28892d338d0a8bf7fb757b931fe3314b3d986db5f13b200b2824a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9c70881eb15fc48a5db08d7bd940655b

SHA1
d210ac17cbd0a862c1517e9349d06224723a3b72

SHA256
a971dbdf483423f5291447735ac31bb2dd051725cb2ede86c902a4774009fc3a

SHA512
a374c85301041ea943a5d96c1b9bbb3d00efcff244fa0a57e92f5b6fb02e852183fc53872db557d25abd7503004dc69431587a8459c4cd8c2bfc18fd494aa270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
60e95b7c9ea3d8a90a3ce41f1cddd413

SHA1
159cfda46e181ffcfac0db77611e20f613d8a8ec

SHA256
e144c3d304ac5f1d70c3d09f3968e0c3271d49651ed71c46f137e99f9e19053d

SHA512
eb9f40d580363fc13b9b063674fa846d4a26d0d17ad403fc5f62fbe5b2580cf2ecdd64395bb1d4fc53a7bdece7c1872f70bb0870bada3d6c601ff7525d1598b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bf439e87a70b2a320f048a8fc8a71879

SHA1
1942384526e350675e8b0c36b1435d85b99e3222

SHA256
520b3cfc164e29c81e8e64975f19383bc37025efd3f5da1b40dd5c84ffc90f21

SHA512
925e0855c2a276b2f1a3d389bf1e285b4482790d11636c2015aee8eeb4d08faf4adf4632232c252680181a343c72b98da42c9232809b02ced2779503a08dad20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
512de6587f0ea32fc0a2322ca0e0d21d

SHA1
6612d8c4fd4b9277e8311d0daee1d66ec97a2290

SHA256
bf57fa4d979800a4184053aeddc2987b2c052f1a6323d849f6043a61592b11c7

SHA512
5848ce55bd6d6a791948eedc97fa5a0ab6b80964b0ef93f9ba88ecbbfe52967ffb3232d701617d0693086cadb2a140f9900cd963f9884614f3ef1eeeaeb1f492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9e9320a1367e057e1f15a1e0c24d42d1

SHA1
9b0d02433a398364abdfda39d0b4d0ce9152ee58

SHA256
a9c4ddef87532a79958c7588039a45da4727b47d532121421bfab29025e24d94

SHA512
8f47746051a3320ed125f2cf0a5c7231299d405941de28ce3e99bc59b4221856acbecb3358411fd72d5281b509f736b0cc5ae607fa455aea8225c3bce16a7c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
523bcd369a7c5e36f338a08dab757c63

SHA1
d9181b58088550fcd3cd8c9eb301d5238e30cf03

SHA256
eacdba1a52261f32786b7831138d104931090465e9cacfbad2a0d1d78527d0b6

SHA512
0c61a4c0e2e6c5e5a9bf4f3c9929b261fdb6b37503a063f3c4629b5f461707fbd2c979a524b321259655077e0347ec90675cf0646396da588cfe8972c3b57994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c2c36663c4cb6727956f73464792d1bb

SHA1
046bd52aa437a9c623898906a652de227f4a47ec

SHA256
594aa2d241f3a037ad64027c175bcd6b3179b77bcc643ba3629778a1201659f3

SHA512
6a99d1422aa8e0b61d86bbee7e005c083c9c87a7773f330397a4f9056d4748dd447c8c6bee93eb8934d8c07adc138b61152f4041c186c714000d990e224976da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b568405eae96436ca40b539ebdc8622d

SHA1
f532668a9aafde21f6aca5a19b4f119836aaba96

SHA256
0000de93dda190d90010cb004e040bad8647c5d28f76991cbf88778ed073dc15

SHA512
f3203bb508cfa218aae60891001337fc6bd63811ec8e033e6711299ec8aedc9e87eb4034234b150fa3162f57adffe9f3018ed35983aa1c50706c7ea692867091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
47fb7d81cfe21f8bce521473c67d47ba

SHA1
156b464b4d5d4fe7e93b4cc41737aec0a5021951

SHA256
c14ef8b7edf2666586f82984bfbaa994c9263d40dfa9131a19316337330b7c22

SHA512
032083da7f39354e0fedddff7265bec3117b8b2524aca3e15e5bca37a27f1e712ae87e9d7a8ba46817da0bc85a706eac1760db0161e4fa9fcb1a1c2bcb267ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4ef9d263269b9a6c1223567dc65a13ab

SHA1
6791e6717d3a3e3c3e37c5f4adad89bc518d011d

SHA256
1e6f19ebb6ac585846a701f7b7c84cf5fc0da8896dd19d87df2c65495e060136

SHA512
ffd1d29d6720554f782db2d5415cafb8a15f61754a5faa119df84303c12433fb035e72b2e1c97e28bce18b8f9f1552826abd32231516b7dfd95f15dc4bb8852e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5df654f01e2a6ad2fd06d31f0b30accb

SHA1
5d2939457bb28d7ab8fb4a851599e13f5858f866

SHA256
e351cc6455ce31278513e9e6e466fdead17e38df3706eff6b73b96b68cc85313

SHA512
9d4e964705af169a29358fa1b7463952b4bd2b1edc7cad7a5f451b05955eaf737103d3926bcee2d982c3e7a8538026285f82a559aa3cff886133dcd0726bd120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9612485d9e31acf193efb636ac638805

SHA1
579c6ad489cf4ed6897054c75fa448a13286006b

SHA256
c3d636c19f12e6d94f755337f42374117b512b5ed9ed54052f90dff713c04934

SHA512
dc2b6c1847681a9e704a1e15b1c4aa9bbee09514f5c84c690f180807fc9cd838af43b41957500d9593e9f81740141a6a957cb636e1f659d50f4952f2c73d89de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
859ac8fbf1304f3700771221bc385a1e

SHA1
b2e761491b3c5151300274a42d0954db8b9cdc72

SHA256
6d25a9cd89eb73b8e8c2d4fa92411764a0f123e74e30a924afd80396974c0805

SHA512
aec6ca2e65aebccc83e3bf678ef65b80a373c04e9499bb884da35a08909c7340bb15743eda56a7156a7b8631320cf66f604a7c29ffc830107873a9d7a5393c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
86e6485bd0d0ff8284189e7dc486a48e

SHA1
a7d31e38698f9447f49efc3280cf34eb9f52bc89

SHA256
a99d7af88ee29279eb094cf1cbc04e24c9efec484a8b75d567c6fd5deab045be

SHA512
bef6feaeb463c63756e0e32a664380f625113ce4eea324a345a58acc051afdf51d4c967baec45117cae5d148e2ff8203281d0539ca80c2627f0b1f82d1f5d4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b0e02847163bb8035852d29ae6e3ede7

SHA1
7a98a8d2c86b8393c6118715e183c998af5397c1

SHA256
a29c1ce632df2605f9d8c7b00b371c421131c23acdb3aa25d415f6c0df96621d

SHA512
9c26901d053d4baefdb5d67450313f02a68838d8bfee59a24e23fadedd690e8f66470ddae86878b7729081ed95b2bced5f535b5eedb080c5e4aa55ff3bd3e61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
895937596c8d614028cbd406595f926e

SHA1
daa0ade45037e98a8e1ac2e8cd6b859c52352448

SHA256
cf8eabc22fc30aa6114d17fc21787515ad519cfb514f123c05c768e6ff0140af

SHA512
f38db06c44f87b689e0b3a67a19a3399e83444fcd6e554003983f10e70da4bf9ed326a6b81ee9b48e3b79765c057dcad37b8fac7fb5f32593823dbbaa2d506ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2a3cdecc2f9f6e86593b70bd76f1be3

SHA1
e77d188274e1a8b6870fd6e7ee8b6266d70e9663

SHA256
959499ec047f2396b732bab8fc98a6df423b96640d7e654fdda180ea43343dd5

SHA512
e1a86cfda6f38894dd72d813ca0ab3f87777abd040b56e10f3bd5b961534b6126a371ec18086f5e9ad787086980de2944c5c6d38b26cf1019f1059f79e0c00ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2573ca06889caf8d2f8f68e505d4f59f

SHA1
ca60f8cb6392929dc9b0f757e92a5a0e01138eb3

SHA256
d5b24747c8275e093e4d2f188bae0fe71e72f605a04b7969b0be5ae77b9c2ce3

SHA512
6b9dc17d4596b45a086a3b71faf7ebf92600cdf50ee00551ad276880c480151a84bbba689bc86a65c70e5fb20ef0f409288242255e38ec5af433f3cde6fa2371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1cd5487571b12ff983f5b12f7bffd714

SHA1
e1237ccff8926a6a7ecec4ff0ec6c396aae4cf6d

SHA256
4577a2f907efd5580e178bab0d73484ee2df10c8f8ded10016ba0a69eb27057e

SHA512
956759efd431e5b3d6fec5896d04d42133afc54d70c8f60dd977510558a6c5ee92b278f977772ddd91c64b54da9de20abbd430c846af6d002dc1242f662d19c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
422005b57e913f5b508f60df50ad4127

SHA1
c2c59398e8a4c63a93069b464ce1ab85ba38f5a5

SHA256
cda1c597b678bfbe0112de85c043db4ec95653906caa24c4876c3f5b00e95ed7

SHA512
c5a5301c3c7fac0c71072c6428d5e2f54ccce7727671bdc291c517d2ddb101edcb1c1ff7cfa7b04507cda009f95caa310eaeefcf3673955489d2b258de6652a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
aa0db30fed862e13f81b4143a10bd1a3

SHA1
9480fc80b99c59ef0d3c25b63b813942b2c3c10c

SHA256
a6fe80cbd3721a642658c1de985db270a49d22c47558d51d70b54d2d6b50a72e

SHA512
b68bb1c7004b8337ee7c4117973c2ded20fd031379a589e987b69ae5b09da0346e77a463b0c867d6d821e693fda5fc0f7fbe30da6b71208b7bd7398eed95f69a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1c9e11a4c41d4d58b4179336f127d187

SHA1
bc626e156acb58246dc600f574ca8eea2e5c1a64

SHA256
c564bbab7e7a434d08902cfd4c41921c8b4e88e113cb205f40e5a485450e5b57

SHA512
c54f0723a6cd5a8c2b0afbf30002c8d652e2d988c11ac78b15d087d56da00ec8db58dce9000beb87d59739efa3ec26d8d9e393cd72c7e7119c05d4a5a0762209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0b0b6ed09dc024538f308effa1a72d27

SHA1
d00bf9da974cd4c34c37b86b59f2ff01ebc48861

SHA256
ba95389e01cb084731e27423d5d8dd79f4b93302bdfa37a7f17c0163a7262159

SHA512
092ae222fcce268fa2654f3a44cfa39ee73c9bf8f6974b8b1fca2d29be6794c05e8ca4f0e381a2827f5627dd4548852b21700a95199ea1ff6c891bbe06db359e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8558b4cadc65bbf9b9ff354a9f04c41c

SHA1
f472be210574a6d1bb05ba335cdb5220e4be07fd

SHA256
f88404437eaeb2432e65a19c77a8228c27eb36b50dc63a52df314ede7b9855d4

SHA512
524f74506a6002489a420aa3dca1110386a6e7d6173d0b6b344dcfbc13a1395a8197862890300aacd3836b69d6c4b15b3219e0d4cb903e3a8e411f92320189fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
310c9b466305022fd59d50bb368cf3eb

SHA1
1c8dbe4edb401213ab177b9b7e5cdadcd01aebb2

SHA256
730754fb5fc7425d054f737dd7b000dddbefd5a331cf882bfcb5808949bc1eed

SHA512
853526f17462b8b5412918a58b4cd57e9b5c2221f1784a4879a741617687783237b09b31b6889531550a8a18a230692db77d31e7815416c6a6cf05fc1da4e94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ab05e7dbe4c5644978dd0e0384d55431

SHA1
9dbb0d578724429cec5fa5323b2d4df9dab29234

SHA256
e8e022ab719a613eec141b87749c32a894cfd93c154f5bfae9a9f8737cfc9b85

SHA512
1c7a575e96e559667cfddaacf1b7f37de724008e5dfa0e93c5194f976b06d7658411d65f0a9ee33b44134d5cdfb82be2af620c3cc24f4c4041e49ee1d58fb113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f866846f627f6b14ca6dc8d3530759e9

SHA1
8702e42013cc8a320377c7eb9e0c508e144ef5f1

SHA256
41966346c556ebc2b818b16211a0e1475bcb7018d266bb7e5f11017e87a464c3

SHA512
e934f7321b76f8ae453d1113a9e305a71004b005d22ee5f6deb70defb4458af63f01c90e7972c29b056c046ca6d145f65b2c788e5778b3f640c760bc6cf887b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6ad341.TMP

Filesize
1KB

MD5
d776ae7aaa704f2343254e7d412ce036

SHA1
b637f483e2d6d218614a829afc6516e8a60a438f

SHA256
84dbeb9451ff49bf71a9e6a2efdcab1174e3c83732ce7b16d6456e27fff38616

SHA512
927de9290e26467bebac5066f97fcbde60e09d670edd10254379f12f70873f59e4fbf00291dbb9daf64d875845a736fe1ff3541bafc1191152929152916f1415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6a037d2-d1aa-40bb-89dd-2d4cd2548d6e.tmp

Filesize
9KB

MD5
2c2bb2db71d89fe0477cc8c0a3e74000

SHA1
5a73649d21b5608150d6a8b0602a1e54512f226f

SHA256
8e7708cf32da7b58e9210380633d7c501ddba10aedf7f5499aabf3c11aba5ed8

SHA512
1753b4a7d3c7243d424148f12213e6103df0a253e238facc81e54c49b079c9ef093dd9a792e4acc968f7d0a5c339ade001c85b41406b910706651f73b048931e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff696a1d07aa75506f358f820fbf37c6

SHA1
0d0442bfa5a82ec87dcce0507ec7e8024764e636

SHA256
196a02630af41f456f5a8d4cf6bbdfb3c6b66e9dbbf180814f46e19f1a4f9916

SHA512
23d50678468ca5ad93d33f720b2c9f354716bbad2486622e6b5b4df229121b5ac4d690dc4defd0c1608280a1f6a531e929883613a4f0d24b2f427da51661af52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0c8332cced51dd27b11839b9f11afb1f

SHA1
c1924c91fc14060d7c4097da78f20c556a73fc72

SHA256
5514b16f166fd3dd5427bf17ad01806b6d7aed1e20a7077b3dfaa21c33b1e95a

SHA512
5e46e911b9ab21e240b6e09077b3e00e8bc6b3ef5dc1187be68d5012dd09f07d9459782aea96edcc420404ae63e31b42e948250f55e70257a7382ae8513069de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c18287d341e95899689f1133df0c1aff

SHA1
bcee1a9b970d322f904da1e748838d910a5402fc

SHA256
6f49a0b4d853505038741b7b42de4d82b1f2170822ee61365b81540c61f28629

SHA512
f51d9c65574bbff301fac8cdabe68997c5008e2f064b9480d56f0f4849a722c9ca992933bbf57f8b0d46d975b20c265eb3af014e210079d2a14ad1ebb13407aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6a75f27d7a8f4f6dc33d828220f03f57

SHA1
7a3e14d0a7043caba0c09df995175ba855244b16

SHA256
5830dd1efd73cb45d51690046153ce0e1104cf9e3a088119dbd0929aa839d543

SHA512
316624fd82212b201dacd458eddc3104ffe204c26de85d67250a6034ecbbaaacc16ea280816645a4458758e14d9b8a3cba44bf6c4b7962ceaed8b7685eb4186d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e3a1edff6d8bb792a1c5ac28f29bad99

SHA1
24948b673f82ce3dbe3e648f00a1689db5403fa1

SHA256
1b579d06fdc39fc236824d631892a5dd5b5f8244b3fd39146a3911c422301055

SHA512
b10bebea0063eb807cb9aae6e1c536da38ab0a3708155c3c3e6b6f1524f97c424f4859ecebd1d47597661cb5f822bd739b395a93f890e22c79e97cf58c3ef570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cc76cb8fad0c96d276e46fe27da36501

SHA1
8f90c2c69b96847098cf53af2ef7cba55eca0eaf

SHA256
cc08c60b27aa7733648298d7d63f491bba65a5cfe3be8dae4181c3e126eb8875

SHA512
8717910829685c9eecab3c6424fd10678998143ab3bdc9f6f6d39542c969f5484dd28ef4c33286c050feb50b9be5bb46cd5d89294f8a9bec0cc4b0ae885e95d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0c80936e173f100a18a6e1129301a258

SHA1
fc56fa22c1fec201aa2e60fabaeca4e3cec041ba

SHA256
6a2037af126c761ac7ca0ee672e9c72199f13fd2c095f0a1a4e23124fb066f55

SHA512
c0b85e1bc9ed11080a10811962eb991c18a35d22627d325d5a6c7a2fe06a826dacafdb2b074d270abdd79859a62b45e98badc6b2ba45964a963a65fbddb02f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9a73b3c862cb33dfdce0caa0fd37f9d6

SHA1
a8d5c572278a7c59a36685ccbd4430f51415b68a

SHA256
4650239ce7e0e7c6762d285c49f665a2fb909ac84e631dde5f4c058e4ab46f3b

SHA512
a9d8abd23b76b2d90aebdc803d98e680eeb500e00d071a4d622ebd303e2e90ae935f4505dabb118b39e8e4abade0ae717d46951d2f9f5e606f0f1261d4cd099e

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini

Filesize
8KB

MD5
24a75fe52d2799fe8f5dd3f8069fd335

SHA1
8f8da9775498c9b8dbc2360d7d5c7c19d7034e1f

SHA256
d1ee39d4b63ce730ec518691e9f9e5cb5752ae06b83acd5abf5a01031164fc04

SHA512
40bffda27b7ce8a690f1af31b91eaff6893db842e1e4c502720027ba00f464b69bff0862265d141477f9956776489d5db7e2650bf50513b63b4ab23a507d072e

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log

Filesize
803B

MD5
bdfb7e7debc745cb9fa598196f8d9924

SHA1
a121df0c25a11ea3102b3faba757fac67b00d498

SHA256
cb6249b2d68689b347d71b1c93428062803d1970dc5a3b007a0ea9cbb4eeef9a

SHA512
eda5394942ac483da61f3eb117867eeae94736d4a9aecca8c8558b6e4382e4049a9c0766b3c53759f294f4d223e2fd810d68ba01be69423466b0ec6e65a5678d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Filesize
90KB

MD5
d84e7f79f4f0d7074802d2d6e6f3579e

SHA1
494937256229ef022ff05855c3d410ac3e7df721

SHA256
dcfc2b4fa3185df415855ec54395d9c36612f68100d046d8c69659da01f7d227

SHA512
ed7b0ac098c8184b611b83158eaa86619001e74dba079d398b34ac694ce404ba133c2baf43051840132d6a3a089a375550072543b9fab2549d57320d13502260

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
3b40e8f01847d02e3a9e23a4212b38b6

SHA1
6055b8aae8e42a5ba0b87d385b10eab80058b7b4

SHA256
357bd61d056d4ee06371a806cf6dfd2da3902e9ff82b6c27037c22bac00b913e

SHA512
aeb54d7c19d41365d0c8e0696537f97739e1f157a8ecce6687a4124a25d56f9e804f14b3bfe88d6d1739faae454fbf7861493c146153c19a19ad592361631d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\801487f1-0cdc-4143-8f4d-db1e9350170a.tmp

Filesize
6KB

MD5
f57407e505ade0b0e4915d1008e4bf17

SHA1
f9fc8c18b18c2feccab125a0b7d1362df47ff3d3

SHA256
c8f08affcd5000f6ca0644a4a041674ab5164afb1cf676b0b228a1465586ea88

SHA512
7a96270e0c072d4933b0fd1bec94b69da320cc42f64a2f3d2be534f75d01e6e0d4ac5d80efa93f6c8f835f5cdeac68c9ec224fb5f4e55ec8636273db5ec454cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State

Filesize
1KB

MD5
f2d5ed18b944a17ff2cc7e911356f942

SHA1
a523b2955a3778c561a0970c479d4b65bdad0b25

SHA256
726a15117bf92b50648634c6a43ca21e68a48f5555c78b4556332c166a777efa

SHA512
f9f1157730223a9cf4d21cc45a806a4677cb993fca52ec37081cb105301d6e6a35490223f248f331813822fa1efbf945ac8d9e80b928d516d473c74a3b365077

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe72635a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State

Filesize
2KB

MD5
b52597f94fd36e0d5292612ccbda51b2

SHA1
1fe2337cb3fc96f4c6f11374db6556b835530da0

SHA256
767ddf18b46f99998047a2a43586140e2031ae2799a108b1a5fbc8e0b1c4f2bc

SHA512
5ca55d521c2860ddfd06fa6f50865d4562355ed67b1ba3acf478cd96796e13cc1fbffe59be0ed86aaf706982fdbbfac20e82e9ab221d4d0fef6bd681ffe91845

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State

Filesize
1KB

MD5
2026bfc7a34993fd196d3a39bede7056

SHA1
062694fff7554903710fb17d68ac628c20624c50

SHA256
9bf6c1882908cb7cb034832afc0016d522215aa21de58d89a51d6b20629d632f

SHA512
d30ad8166d78143f9ffbe2a138b8f4d059f379902ea70ad2226fade35429d03c0010dfd97de316f3ae1617d124253ec47878c6415dc0b50a786c56f28a14c767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State

Filesize
3KB

MD5
b51a1a0bf7aea79650b0643116567c2c

SHA1
d9f329e0fce83055d9b37caab01bdaaf67a6ef80

SHA256
1739d42497359e59e126ddbde889d34eebc4f04a872b6fb9af3e42b3f356bbb5

SHA512
6dc47a6f1013572ea0f527981bff3b9f7120ddbf6e77d6ee1b2c8305c522dc340e976649a741a3fe684e9dc5a85e2fe424cf8ecf188860863a62cb92b76a6fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State

Filesize
16KB

MD5
e974b11f4667a5bdc8cb99314d0b5514

SHA1
211116514fd07f305f7b3a4d7cbc8d776f58fdad

SHA256
0441b513ca190c6421dd3748a269284b623b6eef2358d5e6456d72a76e5e163a

SHA512
3ff0f476cca9cd219193b3867eaaeac8cd1a46c6af6326d62ab1ce7088892a76a88369800b57c2feaddb6abdb1ebe268cceaa25622bec2f815487c235e095420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State

Filesize
17KB

MD5
0efd69582e9232d62dcaa10e7c772cb0

SHA1
a70e7102166085004798e37c46155b959528fbe9

SHA256
3726ff2dc617d9b9b0d11d4dac2ff28c30f666a34b770306a6899b28f2a6bf09

SHA512
8f961bf4fdde016ead94fa44f7fd3e3bd248cb7157a265f139c7d7379f0f105a3407df3a5b612560d5fc3ff01d5f7ce04166600ebb41b3a836085ba49398fd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe714fe6.TMP

Filesize
1KB

MD5
dfbdd07c770900c167eaa158bce52f7a

SHA1
609585772967ad557d86d6d52ef3477cc6dc2b72

SHA256
ec14e815479a2b2f74a0ea33f5bd21fbe94e91418f85a8823ae7bc2cf4dd19b4

SHA512
c5ac0f82f9232549edfd321137e0f55f727a9db49b01d3da9ae41f86171b85a33c1b9623013af53575fbac04955a8114fc618d11c790cf34e4a54157b1c3d7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

Filesize
24.1MB

MD5
e091e9e5ede4161b45b880ccd6e140b0

SHA1
1a18b960482c2a242df0e891de9e3a125e439122

SHA256
cee28f29f904524b7f645bcec3dfdfe38f8269b001144cd909f5d9232890d33b

SHA512
fa8627055bbeb641f634b56059e7b5173e7c64faaa663e050c20d01d708a64877e71cd0b974282c70cb448e877313b1cf0519cf6128c733129b045f2b961a09b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
f6cfa7437049b1f95fb2d40556b79060

SHA1
ce003f62b0c8094173aec0207a20080a8b169400

SHA256
6893377563132128e8f60e812223740e1cc044146f0a04f63af579b496ed898e

SHA512
28779b204ef6fa8c74dfdaf99fe6e8ed9279098c274119ca09b2b8c9af4525cd51a1638fe586daf599ea3b571681a4db220dba423d3987b9de57bb5d1229da57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
d365dfd2eec6c296e58bc99f9336dbad

SHA1
1d18f379438dca8e2562dc5a85b5a6242ba4e7c6

SHA256
62c9c12c986653d069cfab1a1d0a879d473d42f16e378949aaac7612c0e26d41

SHA512
adda40f45504d5ea710dfbf0eee244895c9e6f82d1a62ea0d6e7ba1906897ea8d348f0fe18a0055e65c12d4bd8f663ef98cd7a4f6ac9c8f0f04febc9f966e2a9

Download Submit
C:\Users\Admin\Downloads\SolaraB2.zip

Filesize
278KB

MD5
ea418b261e24a56105a6d328b60e9cc7

SHA1
4f89568a40fff23b381eb1009a764cc7eaf6580c

SHA256
da9098d4713d46c44b95758bdf17e3d2fa1633b3130c7be47b7111132dc051ff

SHA512
95a04802ae713e00940b6ddb55bc75ea7d3450cf31b5fb9d55f0b44aa3629bbf2695d979e1cdef244b4df987db89475cb7185f648cdaffbaa8189e3187dcc8de

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 243558.crdownload

Filesize
7.6MB

MD5
dbb820772caf0003967ef0f269fbdeb1

SHA1
31992bd4977a7dfeba67537a2da6c9ca64bc304c

SHA256
b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

SHA512
e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f

Download Submit
C:\Windows\Installer\MSI1B95.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSI1C33.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI2185.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\Temp\{83AA827C-DBF7-41E5-A4E8-7A7C9466ACE1}\.ba\BootstrapperApplicationData.xml

Filesize
14KB

MD5
897d75c45bb31fd023c7a866b65edab1

SHA1
708069c8a2dfc1a12a8526f40477e7f69b29409e

SHA256
7889edd102dedeecbfa9e88818ddfc24c6f68bcef133deecc0496687dc6ad604

SHA512
dcb984369c6f2649768824d33c2b701070e8440063bb97864a748a34c86b9d22991ef8dad9fa96d8f82f5a9f31f7d037bdb81041a0ab2c5c6fde22826525efda

Download Submit
C:\Windows\Temp\{83AA827C-DBF7-41E5-A4E8-7A7C9466ACE1}\.ba\license.rtf

Filesize
8KB

MD5
2eabbb391acb89942396df5c1ca2bad8

SHA1
182a6f93703549290bcde92920d37bc1dec712bb

SHA256
e3156d170014ced8d17a02b3c4ff63237615e5c2a8983b100a78cb1f881d6f38

SHA512
20d656a123a220cd3ca3ccbf61cc58e924b44f1f0a74e70d6850f39cecd101a69bce73c5ed14018456e022e85b62958f046aa4bd1398aa27303c2e86407c3899

Download Submit
C:\Windows\Temp\{83AA827C-DBF7-41E5-A4E8-7A7C9466ACE1}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{83AA827C-DBF7-41E5-A4E8-7A7C9466ACE1}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
C:\Windows\Temp\{BB35FD62-699C-4E23-AB27-0AED9DCE7196}\.cr\vc_redist.x64.exe

Filesize
634KB

MD5
cb264f7d256b42a54b2129b7a02c1ce3

SHA1
d71459e24185f70b0c8647758663b1116a898412

SHA256
d6aaee30c9b7edeac6939f78f4a55683c6358d9cc03dac487880d01f18700e83

SHA512
4f623f5d21bc216f3dd040e6d0c663a8ea37efe5d0ce5f4aeb1ef5c1f7c873e19d1abc979d3e40d4dc70e2e4f0fc9a1b114b17d9eb852ea9a41d0f84356cd7cb

Download Submit
C:\Windows\Temp\{F7E8859E-BC85-49DB-BD88-74A2297DD146}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{F7E8859E-BC85-49DB-BD88-74A2297DD146}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\??\pipe\LOCAL\crashpad_4908_CEDBWJDQDLKZITVK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2320-2870-0x0000000006960000-0x00000000069F2000-memory.dmp

Filesize
584KB

Download
memory/2320-2898-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Filesize
40KB

Download
memory/2320-218-0x0000000000C20000-0x0000000000CEE000-memory.dmp

Filesize
824KB

Download
memory/2320-3107-0x0000000000DD0000-0x0000000000DE2000-memory.dmp

Filesize
72KB

Download
memory/2320-219-0x0000000005B50000-0x00000000060F4000-memory.dmp

Filesize
5.6MB

Download
memory/4344-5173-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5177-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5178-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5179-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5180-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5181-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5182-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5183-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5172-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/4344-5171-0x0000014BB2E70000-0x0000014BB2E71000-memory.dmp

Filesize
4KB

Download
memory/5228-5973-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5228-11746-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-4592-0x0000028267E80000-0x0000028267EFE000-memory.dmp

Filesize
504KB

Download
memory/5332-5106-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5211-0x00007FFFD9840000-0x00007FFFD9864000-memory.dmp

Filesize
144KB

Download
memory/5332-5206-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5204-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5184-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5151-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5122-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5123-0x00007FFFD9840000-0x00007FFFD9864000-memory.dmp

Filesize
144KB

Download
memory/5332-5111-0x0000028268860000-0x0000028268898000-memory.dmp

Filesize
224KB

Download
memory/5332-5112-0x0000028267F70000-0x0000028267F7E000-memory.dmp

Filesize
56KB

Download
memory/5332-5110-0x0000028267E70000-0x0000028267E78000-memory.dmp

Filesize
32KB

Download
memory/5332-5108-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-4573-0x000002824D270000-0x000002824D28A000-memory.dmp

Filesize
104KB

Download
memory/5332-5107-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5105-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-5212-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5332-4584-0x0000028267F80000-0x00000282684BC000-memory.dmp

Filesize
5.2MB

Download
memory/5332-4590-0x0000028267A00000-0x0000028267A0E000-memory.dmp

Filesize
56KB

Download
memory/5332-4585-0x0000028267A40000-0x0000028267AFA000-memory.dmp

Filesize
744KB

Download
memory/5332-4587-0x0000028267B00000-0x0000028267BB2000-memory.dmp

Filesize
712KB

Download
memory/5332-4588-0x00000282679C0000-0x00000282679E2000-memory.dmp

Filesize
136KB

Download
memory/5608-12559-0x0000000075190000-0x00000000753A0000-memory.dmp

Filesize
2.1MB

Download
memory/5608-12495-0x0000000075190000-0x00000000753A0000-memory.dmp

Filesize
2.1MB

Download
memory/5608-12494-0x0000000000470000-0x00000000004A5000-memory.dmp

Filesize
212KB

Download
memory/5608-12622-0x0000000000470000-0x00000000004A5000-memory.dmp

Filesize
212KB

Download
memory/5616-12932-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/5616-13151-0x0000000180000000-0x0000000180B0D000-memory.dmp

Filesize
11.1MB

Download
memory/6152-12656-0x00007FFFF4AA0000-0x00007FFFF4AB0000-memory.dmp

Filesize
64KB

Download
memory/6152-12652-0x00007FFFF6A30000-0x00007FFFF6A60000-memory.dmp

Filesize
192KB

Download
memory/6152-12654-0x00007FFFF6AC0000-0x00007FFFF6AC5000-memory.dmp

Filesize
20KB

Download
memory/6152-12653-0x00007FFFF6A30000-0x00007FFFF6A60000-memory.dmp

Filesize
192KB

Download
memory/6152-12651-0x00007FFFF6A30000-0x00007FFFF6A60000-memory.dmp

Filesize
192KB

Download
memory/6152-12650-0x00007FFFF6A30000-0x00007FFFF6A60000-memory.dmp

Filesize
192KB

Download
memory/6152-12663-0x00007FFFF4B50000-0x00007FFFF4B60000-memory.dmp

Filesize
64KB

Download
memory/6152-12662-0x00007FFFF4B50000-0x00007FFFF4B60000-memory.dmp

Filesize
64KB

Download
memory/6152-12661-0x00007FFFF4B50000-0x00007FFFF4B60000-memory.dmp

Filesize
64KB

Download
memory/6152-12660-0x00007FFFF4B50000-0x00007FFFF4B60000-memory.dmp

Filesize
64KB

Download
memory/6152-12659-0x00007FFFF4B50000-0x00007FFFF4B60000-memory.dmp

Filesize
64KB

Download
memory/6152-12658-0x00007FFFF4B30000-0x00007FFFF4B40000-memory.dmp

Filesize
64KB

Download
memory/6152-12657-0x00007FFFF4B30000-0x00007FFFF4B40000-memory.dmp

Filesize
64KB

Download
memory/6152-12649-0x00007FFFF6A30000-0x00007FFFF6A60000-memory.dmp

Filesize
192KB

Download
memory/6152-12655-0x00007FFFF4AA0000-0x00007FFFF4AB0000-memory.dmp

Filesize
64KB

Download
memory/6152-12664-0x00007FFFF4650000-0x00007FFFF4660000-memory.dmp

Filesize
64KB

Download
memory/6152-12668-0x00007FFFF48D0000-0x00007FFFF4900000-memory.dmp

Filesize
192KB

Download
memory/6152-12667-0x00007FFFF4760000-0x00007FFFF4770000-memory.dmp

Filesize
64KB

Download
memory/6152-12666-0x00007FFFF4760000-0x00007FFFF4770000-memory.dmp

Filesize
64KB

Download
memory/6152-12665-0x00007FFFF4650000-0x00007FFFF4660000-memory.dmp

Filesize
64KB

Download
memory/6152-12645-0x00007FFFF68D0000-0x00007FFFF68E0000-memory.dmp

Filesize
64KB

Download
memory/6152-12646-0x00007FFFF68D0000-0x00007FFFF68E0000-memory.dmp

Filesize
64KB

Download
memory/6152-12647-0x00007FFFF69E0000-0x00007FFFF69F0000-memory.dmp

Filesize
64KB

Download
memory/6152-12648-0x00007FFFF69E0000-0x00007FFFF69F0000-memory.dmp

Filesize
64KB

Download
memory/8872-12928-0x0000000006300000-0x0000000006322000-memory.dmp

Filesize
136KB

Download
memory/8872-12929-0x0000000006810000-0x0000000006B64000-memory.dmp

Filesize
3.3MB

Download