Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/07/2024, 23:23

General

  • Target

    Bootstrapper.exe

  • Size

    797KB

  • MD5

    86bf094b70901e55a281e0a0683dd8b3

  • SHA1

    24afc916d186facaf7885363bf335e3e5b7d69b9

  • SHA256

    2a4255d739e42838d49159d7228952b512a2c8ccb6f4b0c8d35543912130dac6

  • SHA512

    2f33349c13f7778869f4e200380acd9c12e41a981a30005ad01aa8c29442d9bfdfb2a76a1b589be1efb2e4a314cbdf92f691a12b0fa487af4160e7d87ff25e56

  • SSDEEP

    12288:e/+ubxKHJg5bbEjlsqRoAQpjFVfG0c4XqCon9hUpVo34u:Q+ubYHYqRoAQpjFVG0HXqlF4u

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Themida packer 16 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1604
    • C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\Temp\{2C20CAA9-1F40-4F12-8A58-2516F20A1C47}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{2C20CAA9-1F40-4F12-8A58-2516F20A1C47}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2676
    • C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=2612.3428.14133492859074726390
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ff9841b3cb8,0x7ff9841b3cc8,0x7ff9841b3cd8
          4⤵
            PID:2352
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:408
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2164 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2716
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2452 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4216
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4612
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4740 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2524
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3048 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1504
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1812,4857893511246908784,3451392451414721936,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3100 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:532
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding A4F6CA3AE1D530BEF0AD49D71B9C4BC9
        2⤵
        • Loads dropped DLL
        PID:4764
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E28EDD9942FB70793FB2B3EA4A5ED83E
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4236
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 407BFEED4CA74D358A6F095D4B4E9807 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\SysWOW64\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2184
          • C:\Windows\System32\wevtutil.exe
            "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:1948
      • C:\Windows\System32\CompPkgSrv.exe
        C:\Windows\System32\CompPkgSrv.exe -Embedding
        1⤵
          PID:1528

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e5790aa.rbs

          Filesize

          1.0MB

          MD5

          ae340b5340e665223f7a73e8f6e43cf7

          SHA1

          407737b7927d856298785961ec5af41b560b6567

          SHA256

          cda1c3bfdf698fc2e0f7dbacf0b3abf14e99b3d01cbaf3db5dc52f561e5cf8a1

          SHA512

          f655d9f2d3d44c7717624b983e2dba87319df4e691aff081b6814878a71fe44e160f0d2dc5dc0e9e968032c27cced5a9f64e2523d3d870eae7263450539dbf27

        • C:\Program Files\nodejs\node_etw_provider.man

          Filesize

          10KB

          MD5

          1d51e18a7247f47245b0751f16119498

          SHA1

          78f5d95dd07c0fcee43c6d4feab12d802d194d95

          SHA256

          1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

          SHA512

          1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

        • C:\Program Files\nodejs\node_etw_provider.man

          Filesize

          8KB

          MD5

          d3bc164e23e694c644e0b1ce3e3f9910

          SHA1

          1849f8b1326111b5d4d93febc2bafb3856e601bb

          SHA256

          1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

          SHA512

          91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

        • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

          Filesize

          818B

          MD5

          2916d8b51a5cc0a350d64389bc07aef6

          SHA1

          c9d5ac416c1dd7945651bee712dbed4d158d09e1

          SHA256

          733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

          SHA512

          508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

        • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

          Filesize

          1KB

          MD5

          5ad87d95c13094fa67f25442ff521efd

          SHA1

          01f1438a98e1b796e05a74131e6bb9d66c9e8542

          SHA256

          67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

          SHA512

          7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

        • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

          Filesize

          754B

          MD5

          d2cf52aa43e18fdc87562d4c1303f46a

          SHA1

          58fb4a65fffb438630351e7cafd322579817e5e1

          SHA256

          45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

          SHA512

          54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

        • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

          Filesize

          771B

          MD5

          e9dc66f98e5f7ff720bf603fff36ebc5

          SHA1

          f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

          SHA256

          b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

          SHA512

          8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

        • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

          Filesize

          730B

          MD5

          072ac9ab0c4667f8f876becedfe10ee0

          SHA1

          0227492dcdc7fb8de1d14f9d3421c333230cf8fe

          SHA256

          2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

          SHA512

          f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

        • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

          Filesize

          1KB

          MD5

          d116a360376e31950428ed26eae9ffd4

          SHA1

          192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

          SHA256

          c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

          SHA512

          5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

        • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

          Filesize

          802B

          MD5

          d7c8fab641cd22d2cd30d2999cc77040

          SHA1

          d293601583b1454ad5415260e4378217d569538e

          SHA256

          04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

          SHA512

          278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

        • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

          Filesize

          16KB

          MD5

          bc0c0eeede037aa152345ab1f9774e92

          SHA1

          56e0f71900f0ef8294e46757ec14c0c11ed31d4e

          SHA256

          7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

          SHA512

          5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

        • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

          Filesize

          780B

          MD5

          b020de8f88eacc104c21d6e6cacc636d

          SHA1

          20b35e641e3a5ea25f012e13d69fab37e3d68d6b

          SHA256

          3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

          SHA512

          4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

        • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

          Filesize

          763B

          MD5

          7428aa9f83c500c4a434f8848ee23851

          SHA1

          166b3e1c1b7d7cb7b070108876492529f546219f

          SHA256

          1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

          SHA512

          c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

        • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

          Filesize

          4KB

          MD5

          f0bd53316e08991d94586331f9c11d97

          SHA1

          f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

          SHA256

          dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

          SHA512

          fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

        • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

          Filesize

          771B

          MD5

          1d7c74bcd1904d125f6aff37749dc069

          SHA1

          21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

          SHA256

          24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

          SHA512

          b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

          Filesize

          168B

          MD5

          db7dbbc86e432573e54dedbcc02cb4a1

          SHA1

          cff9cfb98cff2d86b35dc680b405e8036bbbda47

          SHA256

          7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

          SHA512

          8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

          Filesize

          133B

          MD5

          35b86e177ab52108bd9fed7425a9e34a

          SHA1

          76a1f47a10e3ab829f676838147875d75022c70c

          SHA256

          afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

          SHA512

          3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

        • C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll

          Filesize

          488KB

          MD5

          851fee9a41856b588847cf8272645f58

          SHA1

          ee185a1ff257c86eb19d30a191bf0695d5ac72a1

          SHA256

          5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

          SHA512

          cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

        • C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll

          Filesize

          43KB

          MD5

          34ec990ed346ec6a4f14841b12280c20

          SHA1

          6587164274a1ae7f47bdb9d71d066b83241576f0

          SHA256

          1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

          SHA512

          b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

        • C:\ProgramData\Solara\Monaco\index.html

          Filesize

          20KB

          MD5

          12207f73e175f72175526f73aa23ce83

          SHA1

          1a5184b7cf9505363b02bb8012a802d1032f5238

          SHA256

          8dfd03ab23c85dfb8d60f30e37015fa4e40171292e331c04372f620388799e5f

          SHA512

          d7902c5a36b65b9a2eeaa2a2ce4ed5dcd2c15703362f9c52666c5722dcb10773e8206eda0630358673e2d8a49e16237700d00ae37b38f6e712fd9bea2bb149d1

        • C:\ProgramData\Solara\Monaco\vs\basic-languages\lua\lua.js

          Filesize

          5KB

          MD5

          8706d861294e09a1f2f7e63d19e5fcb7

          SHA1

          fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

          SHA256

          fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

          SHA512

          1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

        • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.css

          Filesize

          171KB

          MD5

          233217455a3ef3604bf4942024b94f98

          SHA1

          95cd3ce46f4ca65708ec25d59dddbfa3fc44e143

          SHA256

          2ec118616a1370e7c37342da85834ca1819400c28f83abfcbbb1ef50b51f7701

          SHA512

          6f4cb7b88673666b7dc1beab3ec2aec4d7d353e6da9f6f14ed2fee8848c7da34ee5060d9eb34ecbb5db71b5b98e3f8582c09ef3efe4f2d9d3135dea87d497455

        • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.js

          Filesize

          2.0MB

          MD5

          9399a8eaa741d04b0ae6566a5ebb8106

          SHA1

          5646a9d35b773d784ad914417ed861c5cba45e31

          SHA256

          93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

          SHA512

          d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

        • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.nls.js

          Filesize

          31KB

          MD5

          74dd2381ddbb5af80ce28aefed3068fc

          SHA1

          0996dc91842ab20387e08a46f3807a3f77958902

          SHA256

          fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

          SHA512

          8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

        • C:\ProgramData\Solara\Monaco\vs\loader.js

          Filesize

          27KB

          MD5

          8a3086f6c6298f986bda09080dd003b1

          SHA1

          8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

          SHA256

          0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

          SHA512

          9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

        • C:\ProgramData\Solara\Newtonsoft.Json.dll

          Filesize

          695KB

          MD5

          195ffb7167db3219b217c4fd439eedd6

          SHA1

          1e76e6099570ede620b76ed47cf8d03a936d49f8

          SHA256

          e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

          SHA512

          56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

        • C:\ProgramData\Solara\Solara.dll

          Filesize

          4.4MB

          MD5

          d2095e81b64ae68f6315e2a84bcf7e77

          SHA1

          c822a738341d9c7a551bb38f5dd9d288975ab45a

          SHA256

          9664bb7b9e94eec10aed5c7b8b198efee20056da51537066d1f4894fd72c7f38

          SHA512

          df43ea1eed8a18224591d34e7ca519c181f1d7999dad53a1b5cc9b2467c1a7e5466ef41f9df51ada51a94aa4cea196ce670c124e5112c2261056207fc7545e15

        • C:\ProgramData\Solara\Solara.exe

          Filesize

          92KB

          MD5

          a03d8871ac626b0e49e2879ae7190d85

          SHA1

          f377ac96377711a66e6518020a71106c036cb8cf

          SHA256

          901d866f9c3bd5bbb6e3482a9488bcc60e7748727515569d4305bea87ab8940a

          SHA512

          04f060fbffc2d097706033e2915f5097aa77b58eaad23d0b3df547f6a78d2ca8717651caed29e2cc2d2e2bd52a09ea43905b7f405d1d4c723ef44e88c3e21ce8

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

          Filesize

          152B

          MD5

          7b8f83f3b4759d609311ce61478adcf3

          SHA1

          dcef2416fba95f2887de55d8bd54177f048bcd29

          SHA256

          d778036838d5fee4b45c066a7f44010712d2bd9be8a72fa14d6f21d3d37b81cd

          SHA512

          70f49bc2acefc5b13ba9ff452e8c3a5742ccd6c93c6dfe193ef4834d123982be20171554c72b4d08cf2df026357dbf415006f1fcc785374afb7992d6d3f0316b

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

          Filesize

          152B

          MD5

          6b42d2cc016d147b4e0435fab7f7f159

          SHA1

          b60bea1de98b88646e7b68b37ff9402d68b10a6a

          SHA256

          4867d71571532ecc1666a177c206c6817de6d6520f790f0dae22537c09662f1c

          SHA512

          8abb55423148d91ea327586069e012fa294a2288ffb9c440715f6276972e969f6ea6d66c94569cdb402b93410ef58d281e012352782d39f37e2a423f8902e07c

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

          Filesize

          20B

          MD5

          9e4e94633b73f4a7680240a0ffd6cd2c

          SHA1

          e68e02453ce22736169a56fdb59043d33668368f

          SHA256

          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

          SHA512

          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network Persistent State

          Filesize

          920B

          MD5

          bc80c5fafdbd27393158bd60650283b6

          SHA1

          4bb764d8dc133aca93374e566d003b8f6eee69b7

          SHA256

          1ea41088fd17bd1c11a5a04fd6c8814cf54ef6f9518eae40f997050e243837d9

          SHA512

          926abe4b2d00cb5c6afc724e5408593bf919e10da7044f3467c5126b1259babf74a46bd56b34288336b8a979ee50319336046a2adc5b93c27428547d2165347a

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network Persistent State~RFe59385c.TMP

          Filesize

          59B

          MD5

          2800881c775077e1c4b6e06bf4676de4

          SHA1

          2873631068c8b3b9495638c865915be822442c8b

          SHA256

          226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

          SHA512

          e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

          Filesize

          3KB

          MD5

          216a237becac8e3a9d2777eaf3f3ab12

          SHA1

          3ed78bdce14907e227f706aa16ddceb61060f809

          SHA256

          c0a8f5eaf262920dfbd552db369755a3294bd66230ae8a169a3c82d202542b2d

          SHA512

          5f8ae915b9ccf27bb46bbaac428c790e65d75f1918176aefff52e0bb22f1eed03349a0fe9ce01711d1115146bcb83e32790ea7b3e7fb11cff0f4957953f661a4

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

          Filesize

          3KB

          MD5

          c2436512029e3726dc0670c86a5a4865

          SHA1

          f98ac8cd979fb2cb08292a412198badb99a44992

          SHA256

          6c6f8d3eb10055bda7909584e6994195c75a70bfc8924ab8bbb3bdf282963f79

          SHA512

          eea59ec92e129e53aa9cd8abc45e2ec454c4076bb82e772cd620ac688b67a61f82effc20e2aa4327f2173ddd2bb0282d11fb495dce33b58a1f23217b33c54dd8

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

          Filesize

          16B

          MD5

          206702161f94c5cd39fadd03f4014d98

          SHA1

          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

          SHA256

          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

          SHA512

          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

          Filesize

          8KB

          MD5

          0b5b9411b6e6ce5ed49f6ac09f4fa290

          SHA1

          3cd9474bbecc70e972d297e4fa9e00a5ad05e971

          SHA256

          50e29ab02119c1f1c80cb17dee669615401ccffb07a2f10d2b888fbf3dfb4ef4

          SHA512

          4131f87d11d97436311ecfcea79baae5b6bae40b744daf7fb8b3819a25606db63221708a2885f00da0545e9e842ea903df18406187e543bb358c1ae8d4ee5f88

        • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe586feb.TMP

          Filesize

          8KB

          MD5

          dc5e231222d3b71f12bbadd76415de03

          SHA1

          6f9b9923ae44c214466a74d1205bdb5edf5c53cd

          SHA256

          7fe75bef18b555cc1f063c6fb47ae5c0a8a5de409be72ff84135bce36e48961f

          SHA512

          0d028243b692d36e8b69378e62b612ffdcc3490dcd07d3f14d43de5bafb59ab30e6f775e1bc47b71e0c2226e099d8bb977519d0f6a4f632441e1befd7e49702b

        • C:\ProgramData\Solara\WebView2Loader.dll

          Filesize

          133KB

          MD5

          a0bd0d1a66e7c7f1d97aedecdafb933f

          SHA1

          dd109ac34beb8289030e4ec0a026297b793f64a3

          SHA256

          79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

          SHA512

          2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

        • C:\ProgramData\Solara\Wpf.Ui.dll

          Filesize

          5.2MB

          MD5

          aead90ab96e2853f59be27c4ec1e4853

          SHA1

          43cdedde26488d3209e17efff9a51e1f944eb35f

          SHA256

          46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

          SHA512

          f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

        • C:\ProgramData\Solara\bin\path.txt

          Filesize

          34B

          MD5

          0e2184f1c7464b6617329fb18f107b4f

          SHA1

          6f22f98471e33c9db10d6f6f1728e98852e25b8f

          SHA256

          dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb

          SHA512

          8e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37

        • C:\ProgramData\Solara\libcurl.dll

          Filesize

          522KB

          MD5

          e31f5136d91bad0fcbce053aac798a30

          SHA1

          ee785d2546aec4803bcae08cdebfd5d168c42337

          SHA256

          ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

          SHA512

          a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

        • C:\ProgramData\Solara\vcruntime140.dll

          Filesize

          99KB

          MD5

          7a2b8cfcd543f6e4ebca43162b67d610

          SHA1

          c1c45a326249bf0ccd2be2fbd412f1a62fb67024

          SHA256

          7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

          SHA512

          e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

        • C:\ProgramData\Solara\zlib1.dll

          Filesize

          113KB

          MD5

          75365924730b0b2c1a6ee9028ef07685

          SHA1

          a10687c37deb2ce5422140b541a64ac15534250f

          SHA256

          945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

          SHA512

          c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

        • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

          Filesize

          30.1MB

          MD5

          0e4e9aa41d24221b29b19ba96c1a64d0

          SHA1

          231ade3d5a586c0eb4441c8dbfe9007dc26b2872

          SHA256

          5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

          SHA512

          e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

        • C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

          Filesize

          24.1MB

          MD5

          e091e9e5ede4161b45b880ccd6e140b0

          SHA1

          1a18b960482c2a242df0e891de9e3a125e439122

          SHA256

          cee28f29f904524b7f645bcec3dfdfe38f8269b001144cd909f5d9232890d33b

          SHA512

          fa8627055bbeb641f634b56059e7b5173e7c64faaa663e050c20d01d708a64877e71cd0b974282c70cb448e877313b1cf0519cf6128c733129b045f2b961a09b

        • C:\Windows\Installer\MSI9451.tmp

          Filesize

          122KB

          MD5

          9fe9b0ecaea0324ad99036a91db03ebb

          SHA1

          144068c64ec06fc08eadfcca0a014a44b95bb908

          SHA256

          e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

          SHA512

          906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

        • C:\Windows\Installer\MSI94C0.tmp

          Filesize

          211KB

          MD5

          a3ae5d86ecf38db9427359ea37a5f646

          SHA1

          eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

          SHA256

          c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

          SHA512

          96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

        • C:\Windows\Installer\MSI9A6F.tmp

          Filesize

          297KB

          MD5

          7a86ce1a899262dd3c1df656bff3fb2c

          SHA1

          33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

          SHA256

          b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

          SHA512

          421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

        • C:\Windows\Temp\{2C20CAA9-1F40-4F12-8A58-2516F20A1C47}\.cr\vc_redist.x64.exe

          Filesize

          634KB

          MD5

          cb264f7d256b42a54b2129b7a02c1ce3

          SHA1

          d71459e24185f70b0c8647758663b1116a898412

          SHA256

          d6aaee30c9b7edeac6939f78f4a55683c6358d9cc03dac487880d01f18700e83

          SHA512

          4f623f5d21bc216f3dd040e6d0c663a8ea37efe5d0ce5f4aeb1ef5c1f7c873e19d1abc979d3e40d4dc70e2e4f0fc9a1b114b17d9eb852ea9a41d0f84356cd7cb

        • C:\Windows\Temp\{928C8286-CD5B-457B-94E6-F7628A8DA0C8}\.ba\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • C:\Windows\Temp\{928C8286-CD5B-457B-94E6-F7628A8DA0C8}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • memory/408-2935-0x00007FF9A60A0000-0x00007FF9A60A1000-memory.dmp

          Filesize

          4KB

        • memory/2612-2915-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-3109-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2918-0x0000021473B50000-0x0000021473B58000-memory.dmp

          Filesize

          32KB

        • memory/2612-2920-0x0000021473BB0000-0x0000021473BBE000-memory.dmp

          Filesize

          56KB

        • memory/2612-2919-0x0000021477A70000-0x0000021477AA8000-memory.dmp

          Filesize

          224KB

        • memory/2612-2913-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2912-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2901-0x0000021474770000-0x00000214747EE000-memory.dmp

          Filesize

          504KB

        • memory/2612-3188-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2899-0x0000021473640000-0x000002147364E000-memory.dmp

          Filesize

          56KB

        • memory/2612-3168-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2897-0x0000021473770000-0x0000021473792000-memory.dmp

          Filesize

          136KB

        • memory/2612-3157-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2896-0x00000214738F0000-0x00000214739A2000-memory.dmp

          Filesize

          712KB

        • memory/2612-3121-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2914-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2894-0x0000021473830000-0x00000214738EA000-memory.dmp

          Filesize

          744KB

        • memory/2612-3098-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2893-0x0000021473BC0000-0x00000214740FC000-memory.dmp

          Filesize

          5.2MB

        • memory/2612-3067-0x00007FF997440000-0x00007FF997464000-memory.dmp

          Filesize

          144KB

        • memory/2612-3066-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-3080-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-3096-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-2890-0x0000021470FD0000-0x0000021470FEC000-memory.dmp

          Filesize

          112KB

        • memory/2612-3093-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/2612-3094-0x0000000180000000-0x0000000180B5F000-memory.dmp

          Filesize

          11.4MB

        • memory/4020-2891-0x0000000074E20000-0x00000000755D1000-memory.dmp

          Filesize

          7.7MB

        • memory/4020-1-0x00000000006B0000-0x000000000077E000-memory.dmp

          Filesize

          824KB

        • memory/4020-2-0x0000000005700000-0x0000000005CA6000-memory.dmp

          Filesize

          5.6MB

        • memory/4020-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

          Filesize

          4KB

        • memory/4020-2477-0x00000000069E0000-0x00000000069F2000-memory.dmp

          Filesize

          72KB

        • memory/4020-2475-0x00000000069B0000-0x00000000069BA000-memory.dmp

          Filesize

          40KB

        • memory/4020-2383-0x0000000074E20000-0x00000000755D1000-memory.dmp

          Filesize

          7.7MB

        • memory/4020-2382-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

          Filesize

          4KB

        • memory/4020-3-0x0000000074E20000-0x00000000755D1000-memory.dmp

          Filesize

          7.7MB

        • memory/4020-5-0x0000000006450000-0x00000000067A7000-memory.dmp

          Filesize

          3.3MB

        • memory/4020-4-0x0000000006420000-0x0000000006442000-memory.dmp

          Filesize

          136KB