Analysis
-
max time kernel
1011s -
max time network
1002s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
General
-
Target
Bootstrapper.exe
-
Size
796KB
-
MD5
76639ab92661f5c384302899934051ab
-
SHA1
9b33828f8ad3a686ff02b1a4569b8ae38128caed
-
SHA256
6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178
-
SHA512
928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee
-
SSDEEP
12288:THeLH6iTPSE54sgweI9oaQJj3r+piq+77xOZ+eMm:THeLHdTSEeyoaQJj3Spiq+77xd
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.98\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation node.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation Bootstrapper.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 44 IoCs
pid Process 2096 Solara.exe 4228 node.exe 2840 Solara.exe 3332 node.exe 5312 MicrosoftEdgeWebview2Setup.exe 624 MicrosoftEdgeUpdate.exe 2988 MicrosoftEdgeUpdate.exe 2796 MicrosoftEdgeUpdate.exe 3816 MicrosoftEdgeUpdateComRegisterShell64.exe 2780 MicrosoftEdgeUpdateComRegisterShell64.exe 4732 MicrosoftEdgeUpdateComRegisterShell64.exe 4376 MicrosoftEdgeUpdate.exe 1056 MicrosoftEdgeUpdate.exe 5264 MicrosoftEdgeUpdate.exe 3856 MicrosoftEdgeUpdate.exe 116 Solara.exe 1296 node.exe 3732 MicrosoftEdgeUpdate.exe 1408 MicrosoftEdge_X64_127.0.2651.98.exe 1072 setup.exe 2680 setup.exe 6112 MicrosoftEdgeUpdate.exe 5308 MicrosoftEdge_X64_127.0.2651.98.exe 4060 setup.exe 4904 setup.exe 4820 setup.exe 988 setup.exe 5576 setup.exe 6100 setup.exe 5568 setup.exe 2356 setup.exe 5728 MicrosoftEdgeUpdate.exe 892 MicrosoftEdge_X64_127.0.2651.98.exe 5580 setup.exe 5604 setup.exe 3832 MicrosoftEdgeUpdate.exe 4288 Solara.exe 2332 node.exe 5592 msedgewebview2.exe 1304 msedgewebview2.exe 5168 msedgewebview2.exe 1992 msedgewebview2.exe 4736 msedgewebview2.exe 2796 msedgewebview2.exe -
Loads dropped DLL 59 IoCs
pid Process 1056 MsiExec.exe 1056 MsiExec.exe 2836 MsiExec.exe 2836 MsiExec.exe 2836 MsiExec.exe 2836 MsiExec.exe 2836 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 1056 MsiExec.exe 2096 Solara.exe 2096 Solara.exe 2840 Solara.exe 2840 Solara.exe 624 MicrosoftEdgeUpdate.exe 2988 MicrosoftEdgeUpdate.exe 2796 MicrosoftEdgeUpdate.exe 3816 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 2780 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 4732 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 4376 MicrosoftEdgeUpdate.exe 1056 MicrosoftEdgeUpdate.exe 5264 MicrosoftEdgeUpdate.exe 5264 MicrosoftEdgeUpdate.exe 1056 MicrosoftEdgeUpdate.exe 3856 MicrosoftEdgeUpdate.exe 116 Solara.exe 116 Solara.exe 3732 MicrosoftEdgeUpdate.exe 3732 MicrosoftEdgeUpdate.exe 6112 MicrosoftEdgeUpdate.exe 5728 MicrosoftEdgeUpdate.exe 3832 MicrosoftEdgeUpdate.exe 4288 Solara.exe 4288 Solara.exe 4288 Solara.exe 5592 msedgewebview2.exe 1304 msedgewebview2.exe 5592 msedgewebview2.exe 5592 msedgewebview2.exe 5592 msedgewebview2.exe 1992 msedgewebview2.exe 1992 msedgewebview2.exe 5168 msedgewebview2.exe 4736 msedgewebview2.exe 4736 msedgewebview2.exe 5168 msedgewebview2.exe 2796 msedgewebview2.exe 2796 msedgewebview2.exe 5168 msedgewebview2.exe 5168 msedgewebview2.exe 5168 msedgewebview2.exe 5168 msedgewebview2.exe 2796 msedgewebview2.exe 5592 msedgewebview2.exe -
resource yara_rule behavioral2/files/0x00070000000241ca-2802.dat themida behavioral2/memory/2096-2835-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2836-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2837-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2838-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2841-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2846-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2096-2848-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-2850-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-2851-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-2853-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-2852-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-2867-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3222-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3236-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3311-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3355-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3359-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3373-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3377-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3384-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3398-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3476-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3541-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3549-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3568-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3729-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3763-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3766-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3771-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3775-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3780-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3784-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3789-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3792-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3797-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3831-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3834-0x0000000180000000-0x0000000180FA6000-memory.dmp themida behavioral2/memory/2840-3839-0x0000000180000000-0x0000000180FA6000-memory.dmp themida -
Blocklisted process makes network request 2 IoCs
flow pid Process 38 4908 msiexec.exe 40 4908 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 316 pastebin.com 351 pastebin.com 28 pastebin.com 100 pastebin.com 117 pastebin.com 113 pastebin.com 313 pastebin.com 322 pastebin.com 350 pastebin.com 358 pastebin.com 299 pastebin.com 27 pastebin.com 107 pastebin.com 298 pastebin.com -
Checks system information in the registry 2 TTPs 18 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2096 Solara.exe 2840 Solara.exe 116 Solara.exe 4288 Solara.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\common.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-paths.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\man\cssesc.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\bin\nopt.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\string.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\win10\identity_helper.Sparse.Stable.msix setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-prefix.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-root.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\owner.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-adduser.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\utils.js msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\msedgeupdateres_lb.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\sl.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\dev.identity_helper.exe.manifest setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\nn.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\content\write.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-install-ci-test.md msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\show_third_party_software_licenses.bat setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\is.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\progress-bar.js msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\yarn.cmd msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\v8_context_snapshot.bin setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\EdgeWebView.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\microsoft_shell_integration.dll setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\chownr.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-support\browser.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\zh-TW.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\or.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\browser.mjs msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\processor.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\addon.gypi msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\package.json msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\msedgeupdateres_sr-Latn-RS.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\ka.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-team.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\javascript\connectExample.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_rekor.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_trustroot.js msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Trust Protection Lists\Mu\Social setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\large-numbers.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\internal\streams\from.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\lib\opts-arg.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\examples\twitterfeed.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-expression-parse\AUTHORS msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Social setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-node-modules.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\agent.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\header.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\index.d.ts msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Advertising setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\identity_proxy\win11\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\rsort.js msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\mspdf.dll setup.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\e57e84d.msi msiexec.exe File opened for modification C:\Windows\Installer\e57e84d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIED8E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIFA06.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\Installer\e57e851.msi msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSIF37D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI183E.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI19E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED6E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF34D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFA36.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI18BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1D42.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF168.tmp msiexec.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe:Zone.Identifier firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4376 MicrosoftEdgeUpdate.exe 3856 MicrosoftEdgeUpdate.exe 6112 MicrosoftEdgeUpdate.exe 5728 MicrosoftEdgeUpdate.exe 3832 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs msinfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID msinfo32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs msinfo32.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease msinfo32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msinfo32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msinfo32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.98\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.98\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe -
Modifies data under HKEY_USERS 52 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680381534480124" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/html\Extension = ".htm" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe,0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument %1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.98\\notification_click_helper.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\0\0 = 56003100000000000d59f77c10007363726970747300400009000400efbe0d59f77c0d59f77c2e000000e4340200000007000000000000000000000000000000574098007300630072006900700074007300000016000000 Solara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\INPROCHANDLER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} MicrosoftEdgeUpdate.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe:Zone.Identifier firefox.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdateSetup.exe\:Zone.Identifier:$DATA MicrosoftEdgeWebview2Setup.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5528 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 Bootstrapper.exe 3044 Bootstrapper.exe 4908 msiexec.exe 4908 msiexec.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2096 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe 2840 Solara.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1452 msinfo32.exe 4836 mmc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5592 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3044 Bootstrapper.exe Token: SeShutdownPrivilege 2728 msiexec.exe Token: SeIncreaseQuotaPrivilege 2728 msiexec.exe Token: SeSecurityPrivilege 4908 msiexec.exe Token: SeCreateTokenPrivilege 2728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2728 msiexec.exe Token: SeLockMemoryPrivilege 2728 msiexec.exe Token: SeIncreaseQuotaPrivilege 2728 msiexec.exe Token: SeMachineAccountPrivilege 2728 msiexec.exe Token: SeTcbPrivilege 2728 msiexec.exe Token: SeSecurityPrivilege 2728 msiexec.exe Token: SeTakeOwnershipPrivilege 2728 msiexec.exe Token: SeLoadDriverPrivilege 2728 msiexec.exe Token: SeSystemProfilePrivilege 2728 msiexec.exe Token: SeSystemtimePrivilege 2728 msiexec.exe Token: SeProfSingleProcessPrivilege 2728 msiexec.exe Token: SeIncBasePriorityPrivilege 2728 msiexec.exe Token: SeCreatePagefilePrivilege 2728 msiexec.exe Token: SeCreatePermanentPrivilege 2728 msiexec.exe Token: SeBackupPrivilege 2728 msiexec.exe Token: SeRestorePrivilege 2728 msiexec.exe Token: SeShutdownPrivilege 2728 msiexec.exe Token: SeDebugPrivilege 2728 msiexec.exe Token: SeAuditPrivilege 2728 msiexec.exe Token: SeSystemEnvironmentPrivilege 2728 msiexec.exe Token: SeChangeNotifyPrivilege 2728 msiexec.exe Token: SeRemoteShutdownPrivilege 2728 msiexec.exe Token: SeUndockPrivilege 2728 msiexec.exe Token: SeSyncAgentPrivilege 2728 msiexec.exe Token: SeEnableDelegationPrivilege 2728 msiexec.exe Token: SeManageVolumePrivilege 2728 msiexec.exe Token: SeImpersonatePrivilege 2728 msiexec.exe Token: SeCreateGlobalPrivilege 2728 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeSecurityPrivilege 3324 wevtutil.exe Token: SeBackupPrivilege 3324 wevtutil.exe Token: SeSecurityPrivilege 2088 wevtutil.exe Token: SeBackupPrivilege 2088 wevtutil.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2096 Solara.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 4288 Solara.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 432 firefox.exe 432 firefox.exe 432 firefox.exe 432 firefox.exe 4836 mmc.exe 4836 mmc.exe 4288 Solara.exe 4836 mmc.exe 4836 mmc.exe 4836 mmc.exe 4836 mmc.exe 4836 mmc.exe 4836 mmc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2728 3044 Bootstrapper.exe 95 PID 3044 wrote to memory of 2728 3044 Bootstrapper.exe 95 PID 4908 wrote to memory of 1056 4908 msiexec.exe 99 PID 4908 wrote to memory of 1056 4908 msiexec.exe 99 PID 4908 wrote to memory of 2836 4908 msiexec.exe 100 PID 4908 wrote to memory of 2836 4908 msiexec.exe 100 PID 4908 wrote to memory of 2836 4908 msiexec.exe 100 PID 4908 wrote to memory of 396 4908 msiexec.exe 102 PID 4908 wrote to memory of 396 4908 msiexec.exe 102 PID 4908 wrote to memory of 396 4908 msiexec.exe 102 PID 396 wrote to memory of 3324 396 MsiExec.exe 103 PID 396 wrote to memory of 3324 396 MsiExec.exe 103 PID 396 wrote to memory of 3324 396 MsiExec.exe 103 PID 3324 wrote to memory of 2088 3324 wevtutil.exe 105 PID 3324 wrote to memory of 2088 3324 wevtutil.exe 105 PID 2096 wrote to memory of 4228 2096 Solara.exe 133 PID 2096 wrote to memory of 4228 2096 Solara.exe 133 PID 2840 wrote to memory of 3332 2840 Solara.exe 136 PID 2840 wrote to memory of 3332 2840 Solara.exe 136 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 4508 wrote to memory of 432 4508 firefox.exe 139 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 PID 432 wrote to memory of 1932 432 firefox.exe 140 -
System policy modification 1 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
cURL User-Agent 18 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 107 curl/8.4.0-DEV HTTP User-Agent header 116 curl/8.4.0-DEV HTTP User-Agent header 118 curl/8.4.0-DEV HTTP User-Agent header 299 curl/8.4.0-DEV HTTP User-Agent header 322 curl/8.4.0-DEV HTTP User-Agent header 358 curl/8.4.0-DEV HTTP User-Agent header 106 curl/8.4.0-DEV HTTP User-Agent header 111 curl/8.4.0-DEV HTTP User-Agent header 115 curl/8.4.0-DEV HTTP User-Agent header 320 curl/8.4.0-DEV HTTP User-Agent header 321 curl/8.4.0-DEV HTTP User-Agent header 102 curl/8.4.0-DEV HTTP User-Agent header 117 curl/8.4.0-DEV HTTP User-Agent header 356 curl/8.4.0-DEV HTTP User-Agent header 357 curl/8.4.0-DEV HTTP User-Agent header 313 curl/8.4.0-DEV HTTP User-Agent header 323 curl/8.4.0-DEV HTTP User-Agent header 359 curl/8.4.0-DEV
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2C185905D8000A3E43ACE234264D2D2E2⤵
- Loads dropped DLL
PID:1056
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BB1EACDF6F49CC6A19E7775018BE2AC12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C08F47DDC7DDD7D29FB2ED4D247DA52E E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5088
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files\nodejs\node.exe"node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" b91771ddadca459e2⤵
- Executes dropped EXE
PID:4228
-
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files\nodejs\node.exe"node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 8acae91ee90b4c422⤵
- Executes dropped EXE
PID:3332
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43a229c2-84e2-4b46-824c-76f1824f8d63} 432 "\\.\pipe\gecko-crash-server-pipe.432" gpu3⤵PID:1932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4e6f562-32ef-443b-857f-a949de694686} 432 "\\.\pipe\gecko-crash-server-pipe.432" socket3⤵
- Checks processor information in registry
PID:1160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 2980 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {216a6da7-d8bd-4ad6-bb64-620d732ad24a} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:4040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35ebbd03-8b71-4076-965a-73918afc87b9} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2584 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {189f7ab2-c242-4b8d-84f1-a858b249ccfc} 432 "\\.\pipe\gecko-crash-server-pipe.432" utility3⤵
- Checks processor information in registry
PID:5396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40038c85-857f-4036-a7dc-eeb7f7cb8531} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:5856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1df3571d-e31d-4bdc-bd2b-804a16fd5fdd} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:5868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3881a5eb-68a9-4a70-968c-993f8d8d415b} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:5880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 6 -isForBrowser -prefsHandle 6176 -prefMapHandle 6172 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e4c0a3-5c56-42d1-8cd9-6cbf133872ca} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:3592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 7 -isForBrowser -prefsHandle 6156 -prefMapHandle 3460 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2607533-c36c-4783-84b0-a1222f95055f} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:5788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 8 -isForBrowser -prefsHandle 3836 -prefMapHandle 6368 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c95b9ab-dfe9-4581-935c-e4d4a7d150ea} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab3⤵PID:552
-
-
C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:5312 -
C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:624 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2988
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2796 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3816
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2780
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4732
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezEwOEZDOTgxLUI2NTQtNDEwNC04NDQxLTExNzY2OEYxMjkyOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyMzA1MTYxNCIgaW5zdGFsbF90aW1lX21zPSI0MDQiLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4376
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{B2907220-99E6-4725-A747-40804D5ED693}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1056
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5264 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDA0QjE4QzEtREM3Ny00MDEyLUE3MjAtRUI2MTlFRUMxMEVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzA1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyOTQ1NzgwOTk5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyNjI2NTc2MiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:3856
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:1408 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1072 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ff78e2fb7d0,0x7ff78e2fb7dc,0x7ff78e2fb7e84⤵
- Executes dropped EXE
PID:2680
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzQ2QUMwQ0QtRkE1RC00MDlFLUE5MTktMTRDOEQ5NDg0NjgxfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFODM2M0UyNS1ENjM0LTREMDQtQTU1RC0wNzIxOTUyM0RGQjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTI4Mjk4MTIyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExMjgyOTgxMjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2OTAwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1PMHRxUzNsb1VhNDhkT3lNQWVGYVRWSXFpcm1KQ0hGWmt1TktiSGxEdEY0cUpKQ1lYTXZVUm9CdWdabWhQYkV1aU14UTRjcVJoNW0ybEVnJTJiSFNGZjRBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzUyOWE0MWNkLTVjMGMtNGNkMC04MDYxLWI3MWZlYWE4YTMzNj9QMT0xNzI0MTY5MDA3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU8wdHFTM2xvVWE0OGRPeU1BZUZhVFZJcWlybUpDSEZaa3VOS2JIbER0RjRxSkpDWVhNdlVSb0J1Z1ptaFBiRXVpTXhRNGNxUmg1bTJsRWclMmJIU0ZmNEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjQyMjg5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzA0MjA1NTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTU4NDQ2NjYxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIwMzE5MjQ1MjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzMTciIGRvd25sb2FkX3RpbWVfbXM9IjQ0MjEzIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NzQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:6112
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
PID:5308 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
PID:4060 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x214,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e84⤵
- Executes dropped EXE
PID:4904
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4820 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e85⤵
- Executes dropped EXE
PID:988
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level4⤵
- Executes dropped EXE
PID:5576 -
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x238,0x23c,0x240,0x234,0x210,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e85⤵
- Executes dropped EXE
PID:5568
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level4⤵
- Executes dropped EXE
PID:6100 -
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e85⤵
- Executes dropped EXE
PID:2356
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhCNDVFOUUtQUU5Qy00ODY0LUJCMzMtMjk5N0YyMEU2M0M2fSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins2M0NFRjcyMC0yQTRGLTQ1RUQtOEREOS01MUQ2Njc1ODIwNUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjIlNUQiIGluc3RhbGxhZ2U9IjExIiBjb2hvcnQ9InJyZkAwLjcwIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjExIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9InswNEMxQzlCOS02OTI2LTQ2QTktOUUzNy02OTE1NUMzNzNCMTZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIxMSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY3MDc3NzY2NjA0NzU5MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ0MDUxMjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ1NjExMDkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MjA3NDEzNjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MzQyODIwNDQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyODk5NjQ2NjczIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTIwNDAiIGRvd25sb2FkZWQ9IjE3MjYwNjQwOCIgdG90YWw9IjE3MjYwNjQwOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzY1MjEiLz48cGluZyBhY3RpdmU9IjEiIGE9IjExIiByPSIxMSIgYWQ9IjY0MjMiIHJkPSI2NDIzIiBwaW5nX2ZyZXNobmVzcz0iezhGQTcwQURELTA0MjYtNDAyMy1CQkJELTlFRDlEQjVFRUZDRn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NDMzIiBjb2hvcnQ9InJyZkAwLjU3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MjVDNTAxQjYtQ0EyRC00N0M3LUIyRTEtN0M4QjdEOEU0OTg4fSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5728
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:892 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5580 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7db1eb7d0,0x7ff7db1eb7dc,0x7ff7db1eb7e84⤵
- Executes dropped EXE
PID:5604
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJCOTg0ODEwLTE1MjktNEJDNy1BMTQyLTNGODJGRTFFMDAwOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtoVmZEak1kRkc2RmdLczBOejZlbXJZQ1NnNlRRdkRQb21vbFJheVFYQks0PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjk4IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTM0OTE4ODc4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEzNDkxODg3OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDI2OTg0NTI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2ODcwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1iWkF4VGtTT01qa28lMmZHTjZ2SEwlMmJwa04ybWRCdmlkOW55Slp1d1FqTVBnQlFDWldPTnYlMmJadk5Ga0EyanRqbTRpekJiNThPVnFMSjZvZEY0UzJVdSUyYjF3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjA2NDA4IiB0b3RhbD0iMTcyNjA2NDA4IiBkb3dubG9hZF90aW1lX21zPSI1ODM1NjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDAyNjk4NDUyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDQxMzU5NDY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDM4OTc4MjQxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3MCIgZG93bmxvYWRfdGltZV9tcz0iNTg5MjA3IiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0ODI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3832
-
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:1452
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:116 -
C:\Program Files\nodejs\node.exe"node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" e90447ea7b1c481f2⤵
- Executes dropped EXE
PID:1296
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:3732
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ApproveLimit.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5528
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4836
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4288 -
C:\Program Files\nodejs\node.exe"node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 4af8fcbecd244a082⤵
- Checks computer location settings
- Executes dropped EXE
PID:2332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4288.2836.112252273442200272512⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:5592 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdca30d198,0x7ffdca30d1a4,0x7ffdca30d1b03⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5168
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1840,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2256,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4736
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3524,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2796
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Discovery
Network Share Discovery
1Peripheral Device Discovery
2Query Registry
10System Information Discovery
9System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55005e643890647582711b490cd99d562
SHA149e731efe89123fefc1afdddfef4e98d24ce434d
SHA256d8d8f7e6a1838190a186b3879ca74d8f09a5ea9a625e838dba69d5cd0d10a8df
SHA5124d1b9696b6589ea1554c1090c45014dccb6e0dcd228910139221ecb19f082478f2762e4594f56ef21970eb0aa6304610816e77159cc62e8f8a84c2c50c784608
-
Filesize
6.6MB
MD5527503f430c5fd4a542f8c0f163fde47
SHA16b4db644895df6c71b547d8b147ef3e327418f9d
SHA256d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628
SHA512ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\SETUP.EX_
Filesize2.6MB
MD52809c98eddd9ccdd623ff84b87e74005
SHA1878cf5743a862e0a3e69742bd1a02201ec766773
SHA256b44f0840029e770338bb3416b713ebeec8fdf3c30c4977de87d72d8d1c91e272
SHA5124da568417881905dfbe604887962f92b1ada3018815ab75cdce6f794c271e86fe4eb48a62959a8f463807c70f307b29e415246ef3f92face6849f94cd317afcf
-
Filesize
201KB
MD5136e8226d68856da40a4f60e70581b72
SHA16c1a09e12e3e07740feef7b209f673b06542ab62
SHA256b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f
SHA5129a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399
-
Filesize
280B
MD5d79ec13ad3b25bc71eda81ebed341244
SHA1a956ba9188bdad7e233cc2c268922a09f6ea7962
SHA2562a82498c8153cc204b36cebd3bf23da763704e07a0ef816a256fac11530e5c63
SHA51217f3e4eb0c2185395c0ec4f93d5df74d0a41d5493dc523018df3d8562eb526f4cb696f62e57f01e89bf877f9f80454bcaf51e211d2c332da5220f7aeced9a47a
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
180KB
MD56fc70e95a37a223beeadc1354ad4c3b5
SHA148ec4670ccde19c0320957c88bc1bff1134f0886
SHA2560d0125b7782272b677645c75310ee1c9c9381c5ffcfd8ce64eabb6272f53c53c
SHA5123f08a0c30b670907d0dcd30a967c196fa79ff208bacd3a64e8c7d470d64e38f3a83d7a9cad7d139f1a0a1660fa81337c345d4ebb67ed6e21cf1d8804cdda1677
-
Filesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
Filesize
6KB
MD50e709bfb5675ff0531c925b909b58008
SHA125a8634dd21c082d74a7dead157568b6a8fc9825
SHA256ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67
SHA51235968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd
-
Filesize
2KB
MD5b9e991c0e57c4d5adde68a2f4f063bc7
SHA10cb6b9eb7b310c37e5950bbcaf672943657c94b5
SHA2569c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241
SHA5123bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6
-
Filesize
1KB
MD5826bd4315438573ba1a6d88ae2a2aa65
SHA13e27986a947e7d10488739c9afb75f96b646c4c5
SHA2560fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956
SHA5122e98ba8e57cb0950e45d20365d16e86ad94a60cfd4cf103b7d55dae02de677985d37c0f771e16ae0a628cb3b59adce8a9e1742cffc298f18cb7d935d72536e6d
-
Filesize
1KB
MD571a7656944ffe50cc27ebe02491ae49b
SHA18ebf0f80660d982fc68f00f82855696157e74b10
SHA2566c3d2c892db282317913ce7c340dd2edccd326bcafd18b644b8738144967d6ee
SHA5125b0010b41304e212a22d2c89eff65ce410b000c71c4ab8c7fdba8f549ba0629fe27f37c142058b041fb889bc73e00959ad58f673866ee7d29724687da3c3f320
-
Filesize
4KB
MD574bdccf347345d27fe8a4ac3add99c60
SHA1a2b8a915c86fc750f56a7137860f19ec1182ee21
SHA256d8d1c1d6c387ab67c3f28d78fd0b20b9becd69442db9d3efe110ca464b509c8a
SHA512c2d47efee2a4442be6375d623f46b4c7ee9552c132b9229eb284bdd98629edd02664167805b0af9b3faaa9b1906e9ed0c5e383396d4995cef7051f9a450e1b99
-
Filesize
263B
MD5dd13897ea2eed92695bb7e4e744a9148
SHA1182314d32e789e4f9c29e3150ae392f1630f171c
SHA2569a34fedeb2d269c46ed94e6f13039eb0d16d866dd460ec66fa3acd78122fa9fe
SHA5120b53bc984178336ac516601e72d477d2beeef6936800da17d3a79c153e0036f7428517ebd75d296729f65856c7e07749029f5aa192b2ac071efc4d3e39750a32
-
Filesize
5KB
MD525807a97fbb1fcc42a013abc7d7768c4
SHA1f24d52cbc9144b011def218234ff7b50e7ddcb19
SHA256a3e83594a4ce88997e2e4fc66bc942b17b9d736290ad62560c7f09d6d0989ad0
SHA5128d316b63700126d7c8965a886e9b35a332d3f7e68d28f2264d235c0afad28066f877f25821e1983ddde5f2d5052716cc73338779b41b6f4d1b90ad33dc3e9f24
-
Filesize
10KB
MD5002a1f3e813cc05d9e3cc011f6601628
SHA11690c27457637ec234d6b7658f1b96e547a0eb99
SHA2564d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91
SHA512ea1ad9bcf09a73a10dd1fd8a66daac12f87725e16ad27e7beff6d9fda937579976cd5d7ed6439c4122b16178c3ffdf410d6c7a54918f94bc98fa7950adf3bd54
-
Filesize
1KB
MD57f0a9d228c79f0ee4b89fc6117f1c687
SHA13c10082c1464a6f589aa10cda88285e780ebf857
SHA2565a3659bcc2e47b25ebf9f23f38eb9452a58920bfe4b59410bfa6fe84639a3b99
SHA5127bdd7259bcb8d79aa41777f03d3a3f8a29b60c2d25104072edba9febeb813e12ef78d31573637702decddbaa97d8fec263bc413bd27dd660ded17d644458cbc2
-
Filesize
1KB
MD5e7a3f46d4b903c9f8a025cb753b1a538
SHA16721b521ac3509731d3d0f9b0074908176e1fcc4
SHA25629d3cccddc7148f48715bfc94eb6f7b9f9132a5ecb704b9d4b713de87e7603dd
SHA5128e679ea25f82928ed7d55a6e2c08a647c6457d84749155716273ba3b33a030c262dd359a3bbb12465a58e3dc89bcec9c3fb7e9ce64b3ecfbf2b14df49b9dafea
-
Filesize
859B
MD53ed21090e07ef5dd57729a77c4291cb9
SHA17ffe61f87f94a558fabc177cad5c9b90b16481cf
SHA256a4eece6ff6b38bf7ac107323f381cc60500097a9cbdd473f5d5b45e68822cb89
SHA51254de61c6ab428104f9a559ecd3df7868ab7f1b5c8b85a3f658c8dab13d435bd0766c6b48178a1d5bd083b0829f6461158e303538c7d08761b201b17f7c9940b3
-
Filesize
1KB
MD5b90cf71779f72e14be703a4e494e968c
SHA1842f42d9ee581d91ac82a7fa018f61bb3f8ef63a
SHA2561d0a4e941c1504dcd9bc6cfbb77f7b44d93e56a29cba6f2ccebd78d501a51c16
SHA5128db5d9a938f397c11c75c77c0cbe6eb609c5d4f81a590f221163fe3291cd0cb2a6286ba8935c8f8cfdabecec9f7e49a5bfa836dc777e936271fbe0daea7414e6
-
Filesize
1KB
MD5453a9bb10c91e0ec44f305b14e30ce82
SHA173c01b81f34a9978b158df2744ef8c45251d6193
SHA25630b1a43843675f42033fd6c77c19b20ad4344844f0bd5526c586081e93a48fe8
SHA512d81ee5f2394493a5f93918ecae6581f82ee529fbbd257e0dc10ea68f09c39d0d19e3a6b0e9560eb1250d88a9b1f591d6469f28404410b16b580cbe179e37da0f
-
Filesize
1KB
MD50c95e46d0f08bd96b93cfbea66888afc
SHA1dfbb19c79eb0ca7ff2625fb1975a35cf47be378a
SHA25642a7f91883d0c5ce9292dda4e017e1f8664d34b09276d89fb6f3859c29d1ca9b
SHA512fbeb545274e55f0dface8407a563878083e8d2edc16320a31802e7b4c1dbf6d37f20b772c7436cb1810adb524ef86b3378b6b76a35e0967b6cae58340c58d4ad
-
Filesize
434B
MD5e9c758769fec9883d5ce3d30b8ee1047
SHA1f9d3fd64a0196e77965489ce9b81fe4ce3a9ecb1
SHA256bd320a3e9d23249f5f7d3ce72f2fa426e28a6b2704bd2b281d0c92806a1f5223
SHA512e54bbb849368a53c620b65d0e4a847869dea8fbb767f3559315d9e031c11f23df4ac9d746b7883caf3f693c748e1b9c90f8789519891ed179399341cd49dcae2
-
Filesize
224B
MD5866e37a4d9fb8799d5415d32ac413465
SHA13f41478fdab31acabab8fa1d26126483a141ffb6
SHA2564d2f5afc192178c5b0dc418d2da5826d52a8b6998771b011aede7fdba9118140
SHA512766d2e202dd5e520ac227e28e3c359cca183605c52b4e4c95c69825c929356cea772723a9af491a3662d3c26f7209e89cc3a7af76f75165c104492dc6728accc
-
Filesize
14KB
MD515cf9c2f48c7ba6583c59d28908e3e27
SHA119c7718f6a3d0f9dcd4ca692c19718ec29aae092
SHA2565901b32f609ba349351bf7406dbdc0c4c57b77ce6f7215ea67ccca5ac2a28e88
SHA512c063277a59b83dffc085116769475ec5cce1c47c167b9bd2246e8bda04f0ebc2773b5f06e3b44fc5ed057e043f6d33e77741f34d15e22542134e3865574a29be
-
Filesize
2KB
MD5d467bc485eddf6d38278bc6b1dc16389
SHA1e233882de62eb095b3cae0b2956e8776e6af3d6a
SHA2562f25585c03c3050779c8f5f00597f8653f4fb8a97448ef8ef8cb21e65ba4d15d
SHA5122add66b4f2e8ce463449ca8f2eac19363844b6ab159a41b42163028c57f07a4245ebefe759a6f90e8685b5bd239c969fe99366eff89378cb8b92b8a703dacd61
-
Filesize
2KB
MD53b5b76b70b0a549dce72c5a02756d2a8
SHA107786baebb5c52882e28a8bd281c9a36d63dd116
SHA256bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859
SHA512bb266dfa725421fb26d26fda0f45a5fa5cd832667b05f27ceaf4e7fc1e032aeea8700493cfdd2941c3c38cd166eee1000d2b9ae3ddef375714e25a2027a943a3
-
Filesize
6KB
MD5d50e9637775204f194d629000189f69c
SHA150d1a1725cb273b0a8e30433dabc43d65f55169b
SHA25696900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540
SHA512563a8375e3ab7936162a9d209800f8b41c416c1500fe24de817871c3e5489e8faf5a4dcb7fb239f697a8736432356e60ecf1578d0aafc0de80d6e0ae90c34aad
-
Filesize
1KB
MD53d09ac571e0b6eaf8fdb9806118b6d30
SHA1eb758bb6a7d3e4f32f0fa2f941265678539e74f1
SHA256243d853d4386c4132508ae9a99e5176b25be7f5cb6967bc1bab241f20e937e72
SHA5120207cf364e3eac974cae61ec68fe3975fd1f1eb6150f51293ce67f62dbb0f27a3d9c193101ef282dcd099fc653ca73cd3c875c18e5e266964038e3334697b5b4
-
Filesize
1KB
MD5b4d3859e603602c87a45682862055af0
SHA1e95cb1c14d70be457eba2ce61b2f4e90a13b21b1
SHA25688564234b9eeb2f0fe2cc5d03f617a97eb4802f126bdd21aa223c3c87c02531c
SHA512b17bb8c8b652f27d8037ed60f28b0d19a68e77bcc45d1e2be7dd304c942f6e85570e9720011f983fb8783d670eb66c0c3174d5fd90690b2aa79c2b402adcd00a
-
Filesize
931B
MD5570e06d8ce0167e07a32ba70fdd56795
SHA139dc652dfa419d46d6fed0835444c603c57077f8
SHA25645ebe570483c48b6460767fc4a0bb69e4dee4bf4becc645b0e0627172a30a580
SHA5129c8ddf41b3207016935affce00108d87f176a9e473a01f03f1110456397c88ee2fbaf34f9e497e6cbff2b65c4f4c7f254a5129b4c1eaa2b85fbebffb8fe43777
-
Filesize
2KB
MD5ae157c9a8e70902576c2d8a06dbcde32
SHA10d10ee921436fa5ff5988445cc67676219dfffbe
SHA2564bd92209cb9dacf3e3773e725acb7aaec43ea9e78540324e4d0f73e5ce9adef7
SHA5124c2f31f1f2a297ab6c55a21d58a5c26cad22c1ed1913e7a48605111d217257ae2d9f26ea889e8610e011ba9b9c487c91ecdb4cea3437534faf905e8fb89ba248
-
Filesize
704B
MD5cbd55880a650b56c3d5acddbbdbee9bc
SHA14d354da7ece1c7d5689b8104f3b6f3dcbac7790e
SHA25630fbfaa3840b2f63978ad4bcd7ed8dc24d277b818e4755fe93eda8cb1bc8b74c
SHA512e329a6f6a38dd33bd60334a8dec4a91aa6e7dab28f0893240374ae6a303c12646399d821403e3b80eb51317d1808e6abf30bd91b0bd99951f96815a22ba105c7
-
Filesize
4KB
MD5b1c3d24b92f25989b8aefc7f6aaa91ba
SHA13f69307bd04cc4dfe71cd13616509f443b48f923
SHA2568e16bae14ec63bac9cdbb50572a7b53061fee914712f5e803ff03c44e8845276
SHA5124225c714bec718d7cc59cd2c91a07a77e41cce3ab52502bf9b5b9ccd7d0ce88c040e0a765e5b2c3576ac8f101dc00fff94f8c7ac7586111a545b228831a11ed0
-
Filesize
1KB
MD5436846dd0f4348ac2ee93c9c5eb291e4
SHA1777e9cd400b42dee1199eacfb325876caeaff3cc
SHA256c812eca4b0dee2317cb446124cb27ae8e5b993c8fdd0144886b629ef6ef53fc1
SHA512d261e261bc9d2e5a39a50c6b072e6da995764769abdc4f9f3cf219cc2296c0e45ee194c3f4f431a248fd1d46d90745ad0b576d2fcb24e59d9208804b9c1532d7
-
Filesize
2KB
MD53750351b6b1aa7f3e65d5499ea45006e
SHA17f8870a8a8d53bda04d1c61037a348b5ae2f7de8
SHA256811223d4a19492ccc642384dc84f0af4ad935557dfe8f63750d7ffd673e40f17
SHA512f50d89b90850793e75919c19024a9f1fd27929628bc9c121d685f73c5472c756c8260f0101269550ee4708d370186472c01ba80a76e9220d1ce763f43725842e
-
Filesize
1KB
MD55b1493bd775444f0994d0b1063db1900
SHA1646dc756ff16c464fcb63e17b2cd5ee4ad4f8b66
SHA25698c7b953c844cac7c0be2d5abc6559c6fd3a6075fd159b04c0f1bf46145bfed2
SHA5125be5ba8e172d288fd8f66dd3afcfae75d9f48d7fed3648bc34b4901fcc3f6ecca59ab7d6a73fda298dbad33a372d74c083696e9169e6a6485e7bc4b166fae318
-
Filesize
1KB
MD5210cda9d522bab0911dff42346dee4be
SHA13328d9bfc82e4f981a1acd2f3f78c524bf85333c
SHA25653bd1b14e481356bf004c0a45f9022d07fbc56bfe849115e141ba302c8818275
SHA5128baf4a077586efc571b3b32c64dfde8a2a0aeb4ecea91e016ff96e40051c0de4e6c09cdb8c0711a2731a77120d9aceac0bf2077d0e14e28853fef90d512ab620
-
Filesize
53B
MD5b9f2ca8a50d6d71642dd920c76a851e5
SHA18ca43e514f808364d0eb51e7a595e309a77fdfce
SHA256f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde
SHA51281b6352bbabd0bffbc50bfcd0cd67dc3c2a7d63bda0bf12421410c0ec8047af549a4928b5c5c3e89ead99aa9240bddb461c618c49287c15d9d4d3a899e8f596a
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD55ac0462702a125b10cad429f1a29ebe5
SHA19a1f9e04fe156e929ef8edecaf9f11c7a5ee9ae2
SHA256eb6c724328e344f63d7fd7207b89e7c192411d624e69d64859f282cd36bf5bb7
SHA512f44af2ce1137bc7c8f9b54e605c6f08c0f1e56861d539e79bc35f6ccc724f8c5df15ba3611622172c21e57e19a2613cce132f6e3ab3e239fb5263b22b0add5aa
-
Filesize
280B
MD5d0769225cb7c27ddc1916eb1772366ce
SHA168db8888e8c95eb93666f781dc0b57551a6515bf
SHA2566d1204f4ee072234595a134f4c2512235822a3f4ff6e2d398faf0f10363cacc8
SHA512f42afff6f563335161fe52728ce9aec048f6596693f36d40ad4f718a4562d64de72d39023a3b03847d7e8084153136a766782b644f1ef20219c1aad4e7210bb6
-
Filesize
256KB
MD55a854921cd15c9115f2815cc1020a8a3
SHA10bdaf2e76472c4d9d30abbc8f12cd24fbec537e5
SHA2568ccee87d534f9507ddcf195ed6cc94ab9da239ca3ce749ed2faf1207c85f9cf6
SHA5121dc5d7be74e6ca4fb50676eda5a5d0696753ddfb2735e47dbb24d664a5f9342d51ae73a49fb6e75464509c19a56431e2d5abe2e142d7c072c99d12133faf52a7
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD576cc951d3dccbe4acc4bd9110c914685
SHA16f0cae911a5971dc416144cb6e6d3df730b27cef
SHA256d8b2ccd7fc1b5497228052c7eedb1580e7fa62ac386452cbda37ef7907db0cdc
SHA512f2514b9773db352ba7160bb9e50038c7fc2aebab834f3d886a225197aa97286d9270cd50eb533bd8e1a1eeb47c4a0c874f037a0622bbc030d21b756eab1c1f13
-
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe67032e.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5831b1cd0750802736cf5d68721855192
SHA12e0e48e6eea6d4e1692b2f506294942cce7a3254
SHA2564b66acc0ece001ac6769b5c7b94f982b14dfdcd9e24be8958fbdc96397bb4266
SHA5124f7121b706cce958ffebd7cec035c286a9ba0a9937637c66c17b034b2837181e892a9a3c2e661c4e08e203f1b3c540bbdc490ae6d4eb7d45d804f207e8132614
-
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\e0c20a5a-9a36-46c0-a5f7-f743d3b8cbcc.tmp
Filesize5KB
MD51b1316d148038db8176109097076bed2
SHA177107745656de6325d490784bd91cfb69f401d62
SHA2562f3dc9aa2fb6c36600b8c8f14cc87306b0c845b82dcec3545b7d6a23cb71b422
SHA512cac08eda554e32c99784beb3afd5b15dae33b65b51a8f3bbe732894f8e6a40726b547d26c947eee97046ba056e00e9100e7cb10874be66e14ee6ee08ca449e0e
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
1KB
MD591fe77a02c4d092afe1c6d244eefb443
SHA1707a13f63359f44bbae8037a4d3b8828a7b9e5b8
SHA256802e76d610ba8fbfafb2d10196ec3187ccef8770e2cb0ab909e48efdf3bb45c3
SHA512ca4c702eecadef4547a5b8985f774867d064c93f41a7c5a4fd4d96ef54db0db1262367abedef67e8ed14b8b98e97f67ec538b33379606657f8c308159e061184
-
Filesize
2KB
MD53b36caff4c9c64138fb145d1c1b26831
SHA1183062427481f38103298d5aef854cc399e1e1e7
SHA25648efd12e3538edeb576a9697d4523954338cc18486d23e487feeb2e54678d61a
SHA5121092a92250eedb2e0a12ffcdd7b8c12a69fb1ff6c2545543035381e793d7ba0780f6c82c62cd2833ec828da69e3fec6084e1b5f5214cc8bc1cfe0f62da820fe3
-
Filesize
3KB
MD51b124ab5861604e5f4b38978edff5f64
SHA17c26e7cda1e9373efeb62a3eb1b48c730eeadda3
SHA256d9e3a97770ab473593b946236f896c3d216aa2a64e4c131346fa8f8979858ec4
SHA5122cd75c5601a5a0ca8677949dfadf12a5188d8617a10d3d9933d915a003db3c6c894fee678c165d589cf791dc4c4343fcd25ff227e51d6e9534f99e13ce04653b
-
Filesize
16KB
MD5595e602ec43a124d7c2c6eb7acde3948
SHA1b1a27b35e88d132a730e75efa8983d5c211432c3
SHA256f3462cdcd222c36cffaee3cb403fb18dd7c96839bc454937a01981282b10f035
SHA512909d83a11377bdec6fa37b5bed3d8d02606276fe059471299b096048080933ece3ba743e5b8d77f5c8a6720ea4452f6cb8206bec26c8f81ab51061d2f47cfdd7
-
Filesize
16KB
MD5cd7adcf6c9193e96436f278b2064fa40
SHA10de16fbe8b7e008095e98431e3b041fee9660b6e
SHA256c27049341d87fad886b2a10f10ba81549d226bb83edcf30aea4beb51e6410e9f
SHA512741181c75233abfa2435fc69dee420862c79441016b0c538e42199edcdec032c5c6f9713910b0698ec378216624fa3e67466f7ebf33e368aed6a06a410bccaea
-
Filesize
1KB
MD5a920fa3460fd44d37d661f4108033e86
SHA15f25c618e85eeaebceb0d77c3ad3e31018385470
SHA256866ce5e4adfc1915597e6f1b893b0fcb238cb936ed387f2df6a56624dbf638cf
SHA51241dc6a15e09283091f28e80037f115afb7fc251a5c24c5a96d4dba015930685e3d6128882a39ad8b5731d609cebb5870e3a7f085691835c7864aff20e55d4f2c
-
Filesize
6.2MB
MD5148923086251ba36d914e9f20b5b1f5d
SHA12deeec4a12ef59b187409cf09b7e6dc90a9cba19
SHA2568f23085c5b3a524154893e1b6280dd7a905a720f5d58f10930a0dad649a7d2ae
SHA512f5ee8a27f10466b0d6eb50759318fe81405a612ca02bdcaa9967b8fb2b373dc96dc321578d3d9ce5ef83e70ea44178bfb600b03d7bc607643457b70f197abbe5
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize18KB
MD53747d4a0963f7a70621635d840480288
SHA1d9c56e1c5dd93742401c0f1caf7a34fcff318824
SHA256aeed6390216e4c22baa66e2d62bcd32657a5720c011335f4d71c38ee691ef23c
SHA5122f18b983e0a4ad19379f952b67cf6af4bb6d93c5952abea8e7840e8e0b59a686febef2a7fee8085e57056e68acd4b1b2e88681088890c5283e498e6e366d2abd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8Y4X6KQZ7D8KB7EIYH8Y.temp
Filesize18KB
MD54e941671c0914a201f26db8b07d7ad0e
SHA1b5706d18ce8776fcb11820a7b8ed138ea802787e
SHA256e7db1769272c94cdf15af2c4dac34d307762c6f7abdbb10970234bbcb5affba0
SHA5125790454c9c3f1b3ec8b8a1def8f187783ea42508fe05dbc3ddb6e78e1102240e4892b5758ccaa3bc5ed030ae21b6c58499519f3ec56c569d172fd0d66bb07549
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
Filesize7KB
MD5d97c351d3e13fde18f51ba614b2b2fcc
SHA1ef420c2cc034ca8f9658a7eec88e4144a5ed3796
SHA256ac2dedaaba121af0e3fbe051af8b77f21b4811f6b9451b2b4e68a8dca7f49aa0
SHA512e32c3b2b06a8b284cb8786b6e0a438534ecfceef635f58aabe45c623639fdfa20c82fdb771b88fce9e66edb0079e0d4047fbb3540c80c2b6be50bf182cfc83b7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
Filesize12KB
MD5605eadd42b0e12438ca70d34eb621c81
SHA166151f6d3499699f27bebf1c59918f3567c1e09a
SHA2568a9b1b83dd68f70a593a44961d3ccf93be723fe43d07e4670346ad9ea959432b
SHA512b60ad754e2d39a00066dbbdd84affb9ac3f43516c4cf8f53e4f5c4a4018da885443c7a214c92697c4796e103b9a5b01d881816dbd93fdde29d1f424b34d6cfd5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD54602a47c09973a52cff0cdad2ad09187
SHA1807a804641095d9dd1a951966ed135186b6e67b7
SHA256068989d11d3b403f95c88422ad942af8e4a6070ee90b2cf3e6cea9fdbd312f47
SHA512e0519fb711052dfee61283591e47c4b61d4e60ddc0f136d996c7a16c3d0e0fcd378e0048310fba4fd5eb8f663148f7dc008dffbd9b029b8553991ab174eec4f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5f8384f16f478c2e2f9659ffed671dc5f
SHA10d7eab756dcb7fdd0d3fcf90abc58521426f9322
SHA2563b9289f6cf688049ba14a8955e634aea4298e9e306a51ae1ec04dc67fd0ffea0
SHA5129fd3bc80a71a30f8d2bdf943aba1faf0a2f6dbd2b6600a65ff7eef202c3e78cbf9c308a12e2137069d0cc7416943e8ebb63ea9183556f47540a1a3f49ebf4b19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5c7849c394dc3d850bfd73b7bd8e61e92
SHA1123adb9f21ea9a1eda9761c7fea7c01ca8648ddd
SHA2565b7d098af1d9796d2cabe7526e2377468600feffb71e48f3473db06493f3d978
SHA512b5e308f386cdc9ac3dcec058ef191e36a3a7f1724cb4a5c3263ed445f6ac480cb044eaf4164f9a881e8c8c97a6ccb2c3c5a5d2b69ff6544dd14a78300c589603
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize60KB
MD5dd4834d59e62a46bda634e66acc77298
SHA1d5e10eaf42e37a9d0aed9dfa617431e5885da4ca
SHA2560e5bcfb286227f5c11925175f11a161d412724115aae03000308500a14bd8896
SHA5125107d525f24347722c6ed59256da233f62ada88d0560fbfdd8a1f329d5958e5c38f29b657332183c87cf6fd3ac5020d7a03cd8092bb920eeff09caeecbfb83a3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize60KB
MD50cb8570f842e987edb158b4a2e5deaf6
SHA11817646eb1d11735af0268f3bf872da88364041b
SHA2565a2b9d87109dcd4828abb13d451228332daf479328519443f743fdc6b94b175a
SHA5127e0bc9f43d3d760300d12c800932cf742c105b018d3f1a3fe7200d0a148107b43f0d2a4a8fa83dc2ae536a899541826f9c86fff2157eb0c10291af848ac04612
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize44KB
MD5fcc6dacc610c9cf2fb9aaaceecfe2fd0
SHA1982fd9c35e13f71bc6bda6d7f725d3d5a23a2f42
SHA2561ad60321693a037d487a30821b351c04709d70783af6e032b4d49c4bd882aca9
SHA5128406e6c2e4b080c38349ad943c3a9d2b7de3cf6a538a7f35f8d09ce90351c656f41f2f8083db03bc6da3b9a69893717fcbce433a2a5734dd585e030f9d32eace
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\9f81c1a9-a0fb-483d-b0d6-72ff97cb60ce
Filesize3KB
MD538177a4a95964cae2f80dae5f8e3915c
SHA1c240b5e297b26107575c1a0d1af7b7376459ebac
SHA256645b35dd1b6a220304bdce339429e08847851f51925e75f21ac3f0516992b95d
SHA51209b34a501342422bc994d9fdb5c0e243a510e04bc470fd5df65eceb5731c0e3a94ddc2f1a9f4ac1debfd90af92f5916de61f42a75c4a73e991911b621df11871
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\b72948b1-e1e7-49bb-a551-76a442a6ff5a
Filesize982B
MD581a55da7536ae8b4fd738c6458cec3f5
SHA1a6f828fd55839cd4e32269bafb6df3e13a4c1dc2
SHA2561c743e121a760105124e65ed30d64c2eff7dc4f2e0a73b33e7736c860d216f0d
SHA512d88cf69b5895eee207224f05df9e1c1472b7e6efb223bd1e56f74db6b9e18873a8bd10d48a3cefbb45520a770554bd8bc29888af8d8718e95184b98a7fa5dfac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\be986ada-2fb6-4bef-99d4-fb9f07183c52
Filesize671B
MD57fbc73f8794eccf9badaaece2932e601
SHA1a7fa98fba61556b058e8d021c4be4f0bb18acc07
SHA25682907d8db2e297fe3bc9cb50301e18088825c476a8b2257bed5909dca4ca4ca3
SHA512e97214abbbf637402966342109114b594226014a3b79225efe0190e3a0ad0c4ebee6e94d5b0fe33ce5d02b33e7df528815d2f0965596282f11bbb825734f8a08
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\c0e2677c-45e2-4360-9651-44c965805bc7
Filesize27KB
MD5051170f7aed200f08f1a7881ec80d7ea
SHA1a54967d7a0c00ed5199b9dbe0ba6983215b46e1d
SHA256d61246282326fe0047d0389244e1c141c1f9200139c2ba8c3d404d5b1166d26e
SHA5121401c852b039016ee0f352f14fa15ec6125e6a9f1e11b5a31f24633b73a441e86efa9fe956298168c49fcb9ec3a835ce90d14c3aca02df7050c8b588b2312a7f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\cfc28fc1-c32e-4ab0-bf7c-dce75158ddb2
Filesize847B
MD5acbd1ce39967b1aa44f4327ab23ba0ea
SHA143eb71699a836bebdf939f523e1eae9db6b4d7c8
SHA256ffd93a1376141edecff811290a830cfdd9adf4c8572b3571ee231640431b21fe
SHA5125c44b9765d0ec5d19e78bde5ccd615ae5b7956d1a30450b1ede443f848930204540570af28534872f0726883b481711a85922b2fc4af73e6fe7332cb503baf03
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD5cec321bf2e59989642668d51f34a16c6
SHA1fa0f23c4ddf42a9ab8747f9dc9bb08ea6f8608a0
SHA256dba200ff9648d644d1f9a998b5bae7bcf849ef4665154c3aa03c4a76fa8d06c8
SHA512baa307e482473cd681794cc37f27e184e179ca24d4c05804096b7847b39923d7b34fb2495eee768edb8a7dcc1f987bd649d6df520dafc5e85e8567e6c53304f6
-
Filesize
12KB
MD5b2d10d23b4d05e6eaf7b5fc9aaf46477
SHA18a91cd34405b3aaabfb9be85ac4d4f234479038b
SHA25604e35bf47e5ff18c23f11c1886b34b57a585a527c3f67c82f253da2f631707a0
SHA512de13881d943036c300f7ceba39f3c46bddf07a20c48e466cdf8dd94893b2b214d7739f26697971fde4a68a4255338452892a1a5267d6e44cb8ff9c3fb1b01ad6
-
Filesize
11KB
MD52b2f934d0f6e0fb7923cf13a9f9e1fd6
SHA12f70239db4cc1ab494100263346b4bfb3aa1bc0b
SHA2569adadb62557dfbd1aaa32365939b1afdc5f033dce7e5179bcda98a081f715e54
SHA512ee7ed1410718859f0082f1eede18d237fdb36d8ca5ad7c6f1741b261e4cd6930b81ff1e6d2842a0c87f03e6bee7121f0e602c32accfb18a75df24fcafd6ab732
-
Filesize
12KB
MD5d394e75fdb502fe64d2759a8cb43a6ab
SHA1e4f28903bd076a4d10c4f1c0c19e4c7ee22bd788
SHA2568a4c3722ba220ca4a828a6e8b453865c2f0c7e8f2207d4fb5bd2fcba5522726f
SHA51262eed0b0aa29358044ad3a97bc5973852e1e67b706095167a0c3e845e21102ce787dacae56b6496393ca7647842e36b245b01781ebc88096df8a860302af887d
-
Filesize
12KB
MD56f1a9f07ce91a91f29e9ca2f41528d1b
SHA1a35ec72d159d6dd64c83ef5666f9ef891c93d216
SHA256d54c06c48f68e3b3debf9fdcac9930b9add6b53b079d7fbb58fbd3574ea57f6b
SHA512890dde4887f760bea12246e5bf96fbc2e91565cea40ec57e6881caa91c22e410e091668add01a89b3660a62433f22138a7ea9ffbe95f8906b355c6bde942f05a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize3KB
MD5c4987c4d5418d31ee4a1a4e1dd553c5a
SHA1ed32636e6dbe969b43447d00bfc0a01dcd6e733a
SHA256af6225d84ac756cca7f1314c304bff0706e5ea26dd9d814f491555a816b103e3
SHA5121e52a2509e9ce8bb66e2cb0b6515a2ba8774f946611567f43fff2ec5790517484444a9cdf6eeeb735c7fdf868cc3a5cc4a45bf5d9c635cc67d87754202f1086d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD56f6a95d1b524555eaab23ce3f8ded91f
SHA11997e87afe07a897df5fd45a96fd9873e93a200b
SHA256fcf2b21d287adc86d485d299cfae93f0a83eed14ca2b964a67b8b09fe2108b2c
SHA51250bcdfc5ea7079328b6aeefaf9ae9dbfb85cdff975487fbc85b53af655897f102ad65989cb347f2960cde527c1daf0a19d777f4aea3751075a83285177a43b4f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize3KB
MD5db87676ddea8cf8fa0b4e7240aed2595
SHA16c1a75e54001f79f40dd4ee6e7013b5a35e3650e
SHA256bfdf9114d0fbaad1ad9822e48d69b4d5e494ae716f75156a94e09641a140b6d1
SHA5125f8ad14fc669dae322d2265a7da6c617e7c05b08732b5fc171beb96f238cd8ea6ce6da46ebf588ad6b0fdbe9c13418fe21a1eea258d65422305631808e24d4b5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD5e56a638dc6764e9bfd189d822e7095a3
SHA17944c710bf9895f77b3682e9ef999ed9d252fb65
SHA2561e3265db1f0b31a89a8e00e274584ffb5ee1ad3be93ff307d03802829d74dacc
SHA51252a77ada37679b8ba328a645577750c6ba3aee30bd0a66768ad03fc2a80f35b500b79d10715ec7b442d96c343f5fc39e6708c5b760dee9c9a0526e80d0414169
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD5f6f8bbe305dbfe77625f56e9137ecec4
SHA1c1865573f8b87b9ffd731a5c392a05a9a8f12c2b
SHA256b954be47f4f40b8a9ce40ee1450daa8c45a69c6aa3ea2524a6a104e55adadd71
SHA5124bef08b606f1a7403f69881d68f43be3466c090766c66fcf7ea08dcaa0d6bcb51178ad28d944413f581876f1789630710d7d154cbdda78d9046c33363320155c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
Filesize15KB
MD5f32767f98059931d3fab3d9e53e74657
SHA14695ede5d94fad245c85b42f3f8db7e1c4419bc3
SHA256366a1c009ef83080312df68e7ac130f53c2982535a551d7381c6af1580fc5d9e
SHA5129d048c714e37f7096fc3148ac077ef0d0681fc519f484e811e16aca9e079813e15ce5a675ca3db1f9af646beea5b07b5e864b7e4d4e1ce9375c58f6d0c2c05c1
-
Filesize
1.6MB
MD545e5ca74b9ae3c3fc6f6a63c609783b6
SHA1f36715bea96d69bb18075fac30b90502c6d2464b
SHA256b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9
SHA512014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec