Analysis

  • max time kernel
    1011s
  • max time network
    1002s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 15:38

General

  • Target

    Bootstrapper.exe

  • Size

    796KB

  • MD5

    76639ab92661f5c384302899934051ab

  • SHA1

    9b33828f8ad3a686ff02b1a4569b8ae38128caed

  • SHA256

    6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178

  • SHA512

    928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee

  • SSDEEP

    12288:THeLH6iTPSE54sgweI9oaQJj3r+piq+77xOZ+eMm:THeLHdTSEeyoaQJj3Spiq+77xd

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 59 IoCs
  • Themida packer 39 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Checks system information in the registry 2 TTPs 18 IoCs

    System information is often read in order to detect sandboxing environments.

  • Detected potential entity reuse from brand microsoft.
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • cURL User-Agent 18 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 2C185905D8000A3E43ACE234264D2D2E
      2⤵
      • Loads dropped DLL
      PID:1056
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BB1EACDF6F49CC6A19E7775018BE2AC1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C08F47DDC7DDD7D29FB2ED4D247DA52E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\SysWOW64\wevtutil.exe
        "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Windows\System32\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2088
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5088
    • C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files\nodejs\node.exe
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" b91771ddadca459e
        2⤵
        • Executes dropped EXE
        PID:4228
    • C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Program Files\nodejs\node.exe
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 8acae91ee90b4c42
        2⤵
        • Executes dropped EXE
        PID:3332
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4508
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Subvert Trust Controls: Mark-of-the-Web Bypass
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43a229c2-84e2-4b46-824c-76f1824f8d63} 432 "\\.\pipe\gecko-crash-server-pipe.432" gpu
          3⤵
            PID:1932
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4e6f562-32ef-443b-857f-a949de694686} 432 "\\.\pipe\gecko-crash-server-pipe.432" socket
            3⤵
            • Checks processor information in registry
            PID:1160
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 2980 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {216a6da7-d8bd-4ad6-bb64-620d732ad24a} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
            3⤵
              PID:4040
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35ebbd03-8b71-4076-965a-73918afc87b9} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
              3⤵
                PID:768
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2584 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {189f7ab2-c242-4b8d-84f1-a858b249ccfc} 432 "\\.\pipe\gecko-crash-server-pipe.432" utility
                3⤵
                • Checks processor information in registry
                PID:5396
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40038c85-857f-4036-a7dc-eeb7f7cb8531} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                3⤵
                  PID:5856
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1df3571d-e31d-4bdc-bd2b-804a16fd5fdd} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                  3⤵
                    PID:5868
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3881a5eb-68a9-4a70-968c-993f8d8d415b} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                    3⤵
                      PID:5880
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 6 -isForBrowser -prefsHandle 6176 -prefMapHandle 6172 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e4c0a3-5c56-42d1-8cd9-6cbf133872ca} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                      3⤵
                        PID:3592
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 7 -isForBrowser -prefsHandle 6156 -prefMapHandle 3460 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2607533-c36c-4783-84b0-a1222f95055f} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                        3⤵
                          PID:5788
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 8 -isForBrowser -prefsHandle 3836 -prefMapHandle 6368 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c95b9ab-dfe9-4581-935c-e4d4a7d150ea} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                          3⤵
                            PID:552
                          • C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe
                            "C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • System Location Discovery: System Language Discovery
                            • NTFS ADS
                            PID:5312
                            • C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                              4⤵
                              • Event Triggered Execution: Image File Execution Options Injection
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks system information in the registry
                              • System Location Discovery: System Language Discovery
                              PID:624
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2988
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2796
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:3816
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:2780
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:4732
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezEwOEZDOTgxLUI2NTQtNDEwNC04NDQxLTExNzY2OEYxMjkyOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyMzA1MTYxNCIgaW5zdGFsbF90aW1lX21zPSI0MDQiLz48L2FwcD48L3JlcXVlc3Q-
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks system information in the registry
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:4376
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{B2907220-99E6-4725-A747-40804D5ED693}"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1056
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks system information in the registry
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        PID:5264
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDA0QjE4QzEtREM3Ny00MDEyLUE3MjAtRUI2MTlFRUMxMEVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzA1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyOTQ1NzgwOTk5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyNjI2NTc2MiIvPjwvYXBwPjwvcmVxdWVzdD4
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Modifies data under HKEY_USERS
                          PID:3856
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                          2⤵
                          • Executes dropped EXE
                          PID:1408
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:1072
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ff78e2fb7d0,0x7ff78e2fb7dc,0x7ff78e2fb7e8
                              4⤵
                              • Executes dropped EXE
                              PID:2680
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzQ2QUMwQ0QtRkE1RC00MDlFLUE5MTktMTRDOEQ5NDg0NjgxfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFODM2M0UyNS1ENjM0LTREMDQtQTU1RC0wNzIxOTUyM0RGQjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTI4Mjk4MTIyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExMjgyOTgxMjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2OTAwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1PMHRxUzNsb1VhNDhkT3lNQWVGYVRWSXFpcm1KQ0hGWmt1TktiSGxEdEY0cUpKQ1lYTXZVUm9CdWdabWhQYkV1aU14UTRjcVJoNW0ybEVnJTJiSFNGZjRBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzUyOWE0MWNkLTVjMGMtNGNkMC04MDYxLWI3MWZlYWE4YTMzNj9QMT0xNzI0MTY5MDA3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU8wdHFTM2xvVWE0OGRPeU1BZUZhVFZJcWlybUpDSEZaa3VOS2JIbER0RjRxSkpDWVhNdlVSb0J1Z1ptaFBiRXVpTXhRNGNxUmg1bTJsRWclMmJIU0ZmNEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjQyMjg5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzA0MjA1NTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTU4NDQ2NjYxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIwMzE5MjQ1MjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzMTciIGRvd25sb2FkX3RpbWVfbXM9IjQ0MjEzIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NzQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:6112
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                          2⤵
                          • Executes dropped EXE
                          PID:5308
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                            3⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Installs/modifies Browser Helper Object
                            • Drops file in Program Files directory
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • System policy modification
                            PID:4060
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x214,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e8
                              4⤵
                              • Executes dropped EXE
                              PID:4904
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                              4⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:4820
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:988
                            • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                              4⤵
                              • Executes dropped EXE
                              PID:5576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x238,0x23c,0x240,0x234,0x210,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:5568
                            • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                              4⤵
                              • Executes dropped EXE
                              PID:6100
                              • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:2356
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhCNDVFOUUtQUU5Qy00ODY0LUJCMzMtMjk5N0YyMEU2M0M2fSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins2M0NFRjcyMC0yQTRGLTQ1RUQtOEREOS01MUQ2Njc1ODIwNUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjIlNUQiIGluc3RhbGxhZ2U9IjExIiBjb2hvcnQ9InJyZkAwLjcwIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjExIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9InswNEMxQzlCOS02OTI2LTQ2QTktOUUzNy02OTE1NUMzNzNCMTZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIxMSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY3MDc3NzY2NjA0NzU5MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ0MDUxMjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ1NjExMDkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MjA3NDEzNjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MzQyODIwNDQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyODk5NjQ2NjczIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTIwNDAiIGRvd25sb2FkZWQ9IjE3MjYwNjQwOCIgdG90YWw9IjE3MjYwNjQwOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzY1MjEiLz48cGluZyBhY3RpdmU9IjEiIGE9IjExIiByPSIxMSIgYWQ9IjY0MjMiIHJkPSI2NDIzIiBwaW5nX2ZyZXNobmVzcz0iezhGQTcwQURELTA0MjYtNDAyMy1CQkJELTlFRDlEQjVFRUZDRn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NDMzIiBjb2hvcnQ9InJyZkAwLjU3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MjVDNTAxQjYtQ0EyRC00N0M3LUIyRTEtN0M4QjdEOEU0OTg4fSIvPjwvYXBwPjwvcmVxdWVzdD4
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:5728
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                          2⤵
                          • Executes dropped EXE
                          PID:892
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            PID:5580
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7db1eb7d0,0x7ff7db1eb7dc,0x7ff7db1eb7e8
                              4⤵
                              • Executes dropped EXE
                              PID:5604
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJCOTg0ODEwLTE1MjktNEJDNy1BMTQyLTNGODJGRTFFMDAwOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtoVmZEak1kRkc2RmdLczBOejZlbXJZQ1NnNlRRdkRQb21vbFJheVFYQks0PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjk4IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTM0OTE4ODc4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEzNDkxODg3OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDI2OTg0NTI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2ODcwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1iWkF4VGtTT01qa28lMmZHTjZ2SEwlMmJwa04ybWRCdmlkOW55Slp1d1FqTVBnQlFDWldPTnYlMmJadk5Ga0EyanRqbTRpekJiNThPVnFMSjZvZEY0UzJVdSUyYjF3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjA2NDA4IiB0b3RhbD0iMTcyNjA2NDA4IiBkb3dubG9hZF90aW1lX21zPSI1ODM1NjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDAyNjk4NDUyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDQxMzU5NDY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDM4OTc4MjQxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3MCIgZG93bmxvYWRfdGltZV9tcz0iNTg5MjA3IiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0ODI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:3832
                      • C:\Windows\system32\msinfo32.exe
                        "C:\Windows\system32\msinfo32.exe"
                        1⤵
                        • Checks SCSI registry key(s)
                        • Enumerates system info in registry
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:1452
                      • C:\ProgramData\Solara\Solara.exe
                        "C:\ProgramData\Solara\Solara.exe"
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:116
                        • C:\Program Files\nodejs\node.exe
                          "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" e90447ea7b1c481f
                          2⤵
                          • Executes dropped EXE
                          PID:1296
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks system information in the registry
                        • System Location Discovery: System Language Discovery
                        PID:3732
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ApproveLimit.txt
                        1⤵
                        • Opens file in notepad (likely ransom note)
                        PID:5528
                      • C:\Windows\system32\mmc.exe
                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
                        1⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:4836
                      • C:\ProgramData\Solara\Solara.exe
                        "C:\ProgramData\Solara\Solara.exe"
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Modifies registry class
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:4288
                        • C:\Program Files\nodejs\node.exe
                          "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 4af8fcbecd244a08
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:2332
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4288.2836.11225227344220027251
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • System policy modification
                          PID:5592
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdca30d198,0x7ffdca30d1a4,0x7ffdca30d1b0
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1304
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5168
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1840,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:3
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1992
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2256,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:4736
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3524,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                            3⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2796

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Config.Msi\e57e850.rbs

                        Filesize

                        1.0MB

                        MD5

                        5005e643890647582711b490cd99d562

                        SHA1

                        49e731efe89123fefc1afdddfef4e98d24ce434d

                        SHA256

                        d8d8f7e6a1838190a186b3879ca74d8f09a5ea9a625e838dba69d5cd0d10a8df

                        SHA512

                        4d1b9696b6589ea1554c1090c45014dccb6e0dcd228910139221ecb19f082478f2762e4594f56ef21970eb0aa6304610816e77159cc62e8f8a84c2c50c784608

                      • C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe

                        Filesize

                        6.6MB

                        MD5

                        527503f430c5fd4a542f8c0f163fde47

                        SHA1

                        6b4db644895df6c71b547d8b147ef3e327418f9d

                        SHA256

                        d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

                        SHA512

                        ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\SETUP.EX_

                        Filesize

                        2.6MB

                        MD5

                        2809c98eddd9ccdd623ff84b87e74005

                        SHA1

                        878cf5743a862e0a3e69742bd1a02201ec766773

                        SHA256

                        b44f0840029e770338bb3416b713ebeec8fdf3c30c4977de87d72d8d1c91e272

                        SHA512

                        4da568417881905dfbe604887962f92b1ada3018815ab75cdce6f794c271e86fe4eb48a62959a8f463807c70f307b29e415246ef3f92face6849f94cd317afcf

                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

                        Filesize

                        201KB

                        MD5

                        136e8226d68856da40a4f60e70581b72

                        SHA1

                        6c1a09e12e3e07740feef7b209f673b06542ab62

                        SHA256

                        b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

                        SHA512

                        9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

                      • C:\Program Files\MsEdgeCrashpad\settings.dat

                        Filesize

                        280B

                        MD5

                        d79ec13ad3b25bc71eda81ebed341244

                        SHA1

                        a956ba9188bdad7e233cc2c268922a09f6ea7962

                        SHA256

                        2a82498c8153cc204b36cebd3bf23da763704e07a0ef816a256fac11530e5c63

                        SHA512

                        17f3e4eb0c2185395c0ec4f93d5df74d0a41d5493dc523018df3d8562eb526f4cb696f62e57f01e89bf877f9f80454bcaf51e211d2c332da5220f7aeced9a47a

                      • C:\Program Files\nodejs\node_etw_provider.man

                        Filesize

                        10KB

                        MD5

                        1d51e18a7247f47245b0751f16119498

                        SHA1

                        78f5d95dd07c0fcee43c6d4feab12d802d194d95

                        SHA256

                        1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

                        SHA512

                        1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

                      • C:\Program Files\nodejs\node_etw_provider.man

                        Filesize

                        8KB

                        MD5

                        d3bc164e23e694c644e0b1ce3e3f9910

                        SHA1

                        1849f8b1326111b5d4d93febc2bafb3856e601bb

                        SHA256

                        1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

                        SHA512

                        91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

                        Filesize

                        818B

                        MD5

                        2916d8b51a5cc0a350d64389bc07aef6

                        SHA1

                        c9d5ac416c1dd7945651bee712dbed4d158d09e1

                        SHA256

                        733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                        SHA512

                        508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

                        Filesize

                        1KB

                        MD5

                        5ad87d95c13094fa67f25442ff521efd

                        SHA1

                        01f1438a98e1b796e05a74131e6bb9d66c9e8542

                        SHA256

                        67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                        SHA512

                        7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

                        Filesize

                        754B

                        MD5

                        d2cf52aa43e18fdc87562d4c1303f46a

                        SHA1

                        58fb4a65fffb438630351e7cafd322579817e5e1

                        SHA256

                        45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                        SHA512

                        54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

                        Filesize

                        771B

                        MD5

                        e9dc66f98e5f7ff720bf603fff36ebc5

                        SHA1

                        f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                        SHA256

                        b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                        SHA512

                        8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

                        Filesize

                        730B

                        MD5

                        072ac9ab0c4667f8f876becedfe10ee0

                        SHA1

                        0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                        SHA256

                        2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                        SHA512

                        f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

                        Filesize

                        1KB

                        MD5

                        d116a360376e31950428ed26eae9ffd4

                        SHA1

                        192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                        SHA256

                        c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                        SHA512

                        5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

                        Filesize

                        802B

                        MD5

                        d7c8fab641cd22d2cd30d2999cc77040

                        SHA1

                        d293601583b1454ad5415260e4378217d569538e

                        SHA256

                        04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                        SHA512

                        278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

                        Filesize

                        16KB

                        MD5

                        bc0c0eeede037aa152345ab1f9774e92

                        SHA1

                        56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                        SHA256

                        7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                        SHA512

                        5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

                        Filesize

                        780B

                        MD5

                        b020de8f88eacc104c21d6e6cacc636d

                        SHA1

                        20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                        SHA256

                        3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                        SHA512

                        4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

                        Filesize

                        763B

                        MD5

                        7428aa9f83c500c4a434f8848ee23851

                        SHA1

                        166b3e1c1b7d7cb7b070108876492529f546219f

                        SHA256

                        1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                        SHA512

                        c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

                        Filesize

                        4KB

                        MD5

                        f0bd53316e08991d94586331f9c11d97

                        SHA1

                        f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

                        SHA256

                        dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

                        SHA512

                        fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

                      • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

                        Filesize

                        771B

                        MD5

                        1d7c74bcd1904d125f6aff37749dc069

                        SHA1

                        21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

                        SHA256

                        24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

                        SHA512

                        b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                        Filesize

                        180KB

                        MD5

                        6fc70e95a37a223beeadc1354ad4c3b5

                        SHA1

                        48ec4670ccde19c0320957c88bc1bff1134f0886

                        SHA256

                        0d0125b7782272b677645c75310ee1c9c9381c5ffcfd8ce64eabb6272f53c53c

                        SHA512

                        3f08a0c30b670907d0dcd30a967c196fa79ff208bacd3a64e8c7d470d64e38f3a83d7a9cad7d139f1a0a1660fa81337c345d4ebb67ed6e21cf1d8804cdda1677

                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

                        Filesize

                        168B

                        MD5

                        db7dbbc86e432573e54dedbcc02cb4a1

                        SHA1

                        cff9cfb98cff2d86b35dc680b405e8036bbbda47

                        SHA256

                        7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

                        SHA512

                        8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

                      • C:\ProgramData\Solara\Monaco\fileaccess\index.js

                        Filesize

                        6KB

                        MD5

                        0e709bfb5675ff0531c925b909b58008

                        SHA1

                        25a8634dd21c082d74a7dead157568b6a8fc9825

                        SHA256

                        ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67

                        SHA512

                        35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\index.js

                        Filesize

                        2KB

                        MD5

                        b9e991c0e57c4d5adde68a2f4f063bc7

                        SHA1

                        0cb6b9eb7b310c37e5950bbcaf672943657c94b5

                        SHA256

                        9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241

                        SHA512

                        3bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\package.json

                        Filesize

                        1KB

                        MD5

                        826bd4315438573ba1a6d88ae2a2aa65

                        SHA1

                        3e27986a947e7d10488739c9afb75f96b646c4c5

                        SHA256

                        0fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956

                        SHA512

                        2e98ba8e57cb0950e45d20365d16e86ad94a60cfd4cf103b7d55dae02de677985d37c0f771e16ae0a628cb3b59adce8a9e1742cffc298f18cb7d935d72536e6d

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\package.json

                        Filesize

                        1KB

                        MD5

                        71a7656944ffe50cc27ebe02491ae49b

                        SHA1

                        8ebf0f80660d982fc68f00f82855696157e74b10

                        SHA256

                        6c3d2c892db282317913ce7c340dd2edccd326bcafd18b644b8738144967d6ee

                        SHA512

                        5b0010b41304e212a22d2c89eff65ce410b000c71c4ab8c7fdba8f549ba0629fe27f37c142058b041fb889bc73e00959ad58f673866ee7d29724687da3c3f320

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\debug.js

                        Filesize

                        4KB

                        MD5

                        74bdccf347345d27fe8a4ac3add99c60

                        SHA1

                        a2b8a915c86fc750f56a7137860f19ec1182ee21

                        SHA256

                        d8d1c1d6c387ab67c3f28d78fd0b20b9becd69442db9d3efe110ca464b509c8a

                        SHA512

                        c2d47efee2a4442be6375d623f46b4c7ee9552c132b9229eb284bdd98629edd02664167805b0af9b3faaa9b1906e9ed0c5e383396d4995cef7051f9a450e1b99

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\index.js

                        Filesize

                        263B

                        MD5

                        dd13897ea2eed92695bb7e4e744a9148

                        SHA1

                        182314d32e789e4f9c29e3150ae392f1630f171c

                        SHA256

                        9a34fedeb2d269c46ed94e6f13039eb0d16d866dd460ec66fa3acd78122fa9fe

                        SHA512

                        0b53bc984178336ac516601e72d477d2beeef6936800da17d3a79c153e0036f7428517ebd75d296729f65856c7e07749029f5aa192b2ac071efc4d3e39750a32

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\node.js

                        Filesize

                        5KB

                        MD5

                        25807a97fbb1fcc42a013abc7d7768c4

                        SHA1

                        f24d52cbc9144b011def218234ff7b50e7ddcb19

                        SHA256

                        a3e83594a4ce88997e2e4fc66bc942b17b9d736290ad62560c7f09d6d0989ad0

                        SHA512

                        8d316b63700126d7c8965a886e9b35a332d3f7e68d28f2264d235c0afad28066f877f25821e1983ddde5f2d5052716cc73338779b41b6f4d1b90ad33dc3e9f24

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\depd\index.js

                        Filesize

                        10KB

                        MD5

                        002a1f3e813cc05d9e3cc011f6601628

                        SHA1

                        1690c27457637ec234d6b7658f1b96e547a0eb99

                        SHA256

                        4d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91

                        SHA512

                        ea1ad9bcf09a73a10dd1fd8a66daac12f87725e16ad27e7beff6d9fda937579976cd5d7ed6439c4122b16178c3ffdf410d6c7a54918f94bc98fa7950adf3bd54

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\depd\package.json

                        Filesize

                        1KB

                        MD5

                        7f0a9d228c79f0ee4b89fc6117f1c687

                        SHA1

                        3c10082c1464a6f589aa10cda88285e780ebf857

                        SHA256

                        5a3659bcc2e47b25ebf9f23f38eb9452a58920bfe4b59410bfa6fe84639a3b99

                        SHA512

                        7bdd7259bcb8d79aa41777f03d3a3f8a29b60c2d25104072edba9febeb813e12ef78d31573637702decddbaa97d8fec263bc413bd27dd660ded17d644458cbc2

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ee-first\index.js

                        Filesize

                        1KB

                        MD5

                        e7a3f46d4b903c9f8a025cb753b1a538

                        SHA1

                        6721b521ac3509731d3d0f9b0074908176e1fcc4

                        SHA256

                        29d3cccddc7148f48715bfc94eb6f7b9f9132a5ecb704b9d4b713de87e7603dd

                        SHA512

                        8e679ea25f82928ed7d55a6e2c08a647c6457d84749155716273ba3b33a030c262dd359a3bbb12465a58e3dc89bcec9c3fb7e9ce64b3ecfbf2b14df49b9dafea

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ee-first\package.json

                        Filesize

                        859B

                        MD5

                        3ed21090e07ef5dd57729a77c4291cb9

                        SHA1

                        7ffe61f87f94a558fabc177cad5c9b90b16481cf

                        SHA256

                        a4eece6ff6b38bf7ac107323f381cc60500097a9cbdd473f5d5b45e68822cb89

                        SHA512

                        54de61c6ab428104f9a559ecd3df7868ab7f1b5c8b85a3f658c8dab13d435bd0766c6b48178a1d5bd083b0829f6461158e303538c7d08761b201b17f7c9940b3

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\encodeurl\index.js

                        Filesize

                        1KB

                        MD5

                        b90cf71779f72e14be703a4e494e968c

                        SHA1

                        842f42d9ee581d91ac82a7fa018f61bb3f8ef63a

                        SHA256

                        1d0a4e941c1504dcd9bc6cfbb77f7b44d93e56a29cba6f2ccebd78d501a51c16

                        SHA512

                        8db5d9a938f397c11c75c77c0cbe6eb609c5d4f81a590f221163fe3291cd0cb2a6286ba8935c8f8cfdabecec9f7e49a5bfa836dc777e936271fbe0daea7414e6

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\encodeurl\package.json

                        Filesize

                        1KB

                        MD5

                        453a9bb10c91e0ec44f305b14e30ce82

                        SHA1

                        73c01b81f34a9978b158df2744ef8c45251d6193

                        SHA256

                        30b1a43843675f42033fd6c77c19b20ad4344844f0bd5526c586081e93a48fe8

                        SHA512

                        d81ee5f2394493a5f93918ecae6581f82ee529fbbd257e0dc10ea68f09c39d0d19e3a6b0e9560eb1250d88a9b1f591d6469f28404410b16b580cbe179e37da0f

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\escape-html\index.js

                        Filesize

                        1KB

                        MD5

                        0c95e46d0f08bd96b93cfbea66888afc

                        SHA1

                        dfbb19c79eb0ca7ff2625fb1975a35cf47be378a

                        SHA256

                        42a7f91883d0c5ce9292dda4e017e1f8664d34b09276d89fb6f3859c29d1ca9b

                        SHA512

                        fbeb545274e55f0dface8407a563878083e8d2edc16320a31802e7b4c1dbf6d37f20b772c7436cb1810adb524ef86b3378b6b76a35e0967b6cae58340c58d4ad

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\escape-html\package.json

                        Filesize

                        434B

                        MD5

                        e9c758769fec9883d5ce3d30b8ee1047

                        SHA1

                        f9d3fd64a0196e77965489ce9b81fe4ce3a9ecb1

                        SHA256

                        bd320a3e9d23249f5f7d3ce72f2fa426e28a6b2704bd2b281d0c92806a1f5223

                        SHA512

                        e54bbb849368a53c620b65d0e4a847869dea8fbb767f3559315d9e031c11f23df4ac9d746b7883caf3f693c748e1b9c90f8789519891ed179399341cd49dcae2

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\index.js

                        Filesize

                        224B

                        MD5

                        866e37a4d9fb8799d5415d32ac413465

                        SHA1

                        3f41478fdab31acabab8fa1d26126483a141ffb6

                        SHA256

                        4d2f5afc192178c5b0dc418d2da5826d52a8b6998771b011aede7fdba9118140

                        SHA512

                        766d2e202dd5e520ac227e28e3c359cca183605c52b4e4c95c69825c929356cea772723a9af491a3662d3c26f7209e89cc3a7af76f75165c104492dc6728accc

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\lib\application.js

                        Filesize

                        14KB

                        MD5

                        15cf9c2f48c7ba6583c59d28908e3e27

                        SHA1

                        19c7718f6a3d0f9dcd4ca692c19718ec29aae092

                        SHA256

                        5901b32f609ba349351bf7406dbdc0c4c57b77ce6f7215ea67ccca5ac2a28e88

                        SHA512

                        c063277a59b83dffc085116769475ec5cce1c47c167b9bd2246e8bda04f0ebc2773b5f06e3b44fc5ed057e043f6d33e77741f34d15e22542134e3865574a29be

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\lib\express.js

                        Filesize

                        2KB

                        MD5

                        d467bc485eddf6d38278bc6b1dc16389

                        SHA1

                        e233882de62eb095b3cae0b2956e8776e6af3d6a

                        SHA256

                        2f25585c03c3050779c8f5f00597f8653f4fb8a97448ef8ef8cb21e65ba4d15d

                        SHA512

                        2add66b4f2e8ce463449ca8f2eac19363844b6ab159a41b42163028c57f07a4245ebefe759a6f90e8685b5bd239c969fe99366eff89378cb8b92b8a703dacd61

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\package.json

                        Filesize

                        2KB

                        MD5

                        3b5b76b70b0a549dce72c5a02756d2a8

                        SHA1

                        07786baebb5c52882e28a8bd281c9a36d63dd116

                        SHA256

                        bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859

                        SHA512

                        bb266dfa725421fb26d26fda0f45a5fa5cd832667b05f27ceaf4e7fc1e032aeea8700493cfdd2941c3c38cd166eee1000d2b9ae3ddef375714e25a2027a943a3

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\finalhandler\index.js

                        Filesize

                        6KB

                        MD5

                        d50e9637775204f194d629000189f69c

                        SHA1

                        50d1a1725cb273b0a8e30433dabc43d65f55169b

                        SHA256

                        96900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540

                        SHA512

                        563a8375e3ab7936162a9d209800f8b41c416c1500fe24de817871c3e5489e8faf5a4dcb7fb239f697a8736432356e60ecf1578d0aafc0de80d6e0ae90c34aad

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\finalhandler\package.json

                        Filesize

                        1KB

                        MD5

                        3d09ac571e0b6eaf8fdb9806118b6d30

                        SHA1

                        eb758bb6a7d3e4f32f0fa2f941265678539e74f1

                        SHA256

                        243d853d4386c4132508ae9a99e5176b25be7f5cb6967bc1bab241f20e937e72

                        SHA512

                        0207cf364e3eac974cae61ec68fe3975fd1f1eb6150f51293ce67f62dbb0f27a3d9c193101ef282dcd099fc653ca73cd3c875c18e5e266964038e3334697b5b4

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\merge-descriptors\index.js

                        Filesize

                        1KB

                        MD5

                        b4d3859e603602c87a45682862055af0

                        SHA1

                        e95cb1c14d70be457eba2ce61b2f4e90a13b21b1

                        SHA256

                        88564234b9eeb2f0fe2cc5d03f617a97eb4802f126bdd21aa223c3c87c02531c

                        SHA512

                        b17bb8c8b652f27d8037ed60f28b0d19a68e77bcc45d1e2be7dd304c942f6e85570e9720011f983fb8783d670eb66c0c3174d5fd90690b2aa79c2b402adcd00a

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\merge-descriptors\package.json

                        Filesize

                        931B

                        MD5

                        570e06d8ce0167e07a32ba70fdd56795

                        SHA1

                        39dc652dfa419d46d6fed0835444c603c57077f8

                        SHA256

                        45ebe570483c48b6460767fc4a0bb69e4dee4bf4becc645b0e0627172a30a580

                        SHA512

                        9c8ddf41b3207016935affce00108d87f176a9e473a01f03f1110456397c88ee2fbaf34f9e497e6cbff2b65c4f4c7f254a5129b4c1eaa2b85fbebffb8fe43777

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ms\index.js

                        Filesize

                        2KB

                        MD5

                        ae157c9a8e70902576c2d8a06dbcde32

                        SHA1

                        0d10ee921436fa5ff5988445cc67676219dfffbe

                        SHA256

                        4bd92209cb9dacf3e3773e725acb7aaec43ea9e78540324e4d0f73e5ce9adef7

                        SHA512

                        4c2f31f1f2a297ab6c55a21d58a5c26cad22c1ed1913e7a48605111d217257ae2d9f26ea889e8610e011ba9b9c487c91ecdb4cea3437534faf905e8fb89ba248

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ms\package.json

                        Filesize

                        704B

                        MD5

                        cbd55880a650b56c3d5acddbbdbee9bc

                        SHA1

                        4d354da7ece1c7d5689b8104f3b6f3dcbac7790e

                        SHA256

                        30fbfaa3840b2f63978ad4bcd7ed8dc24d277b818e4755fe93eda8cb1bc8b74c

                        SHA512

                        e329a6f6a38dd33bd60334a8dec4a91aa6e7dab28f0893240374ae6a303c12646399d821403e3b80eb51317d1808e6abf30bd91b0bd99951f96815a22ba105c7

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\on-finished\index.js

                        Filesize

                        4KB

                        MD5

                        b1c3d24b92f25989b8aefc7f6aaa91ba

                        SHA1

                        3f69307bd04cc4dfe71cd13616509f443b48f923

                        SHA256

                        8e16bae14ec63bac9cdbb50572a7b53061fee914712f5e803ff03c44e8845276

                        SHA512

                        4225c714bec718d7cc59cd2c91a07a77e41cce3ab52502bf9b5b9ccd7d0ce88c040e0a765e5b2c3576ac8f101dc00fff94f8c7ac7586111a545b228831a11ed0

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\on-finished\package.json

                        Filesize

                        1KB

                        MD5

                        436846dd0f4348ac2ee93c9c5eb291e4

                        SHA1

                        777e9cd400b42dee1199eacfb325876caeaff3cc

                        SHA256

                        c812eca4b0dee2317cb446124cb27ae8e5b993c8fdd0144886b629ef6ef53fc1

                        SHA512

                        d261e261bc9d2e5a39a50c6b072e6da995764769abdc4f9f3cf219cc2296c0e45ee194c3f4f431a248fd1d46d90745ad0b576d2fcb24e59d9208804b9c1532d7

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\parseurl\index.js

                        Filesize

                        2KB

                        MD5

                        3750351b6b1aa7f3e65d5499ea45006e

                        SHA1

                        7f8870a8a8d53bda04d1c61037a348b5ae2f7de8

                        SHA256

                        811223d4a19492ccc642384dc84f0af4ad935557dfe8f63750d7ffd673e40f17

                        SHA512

                        f50d89b90850793e75919c19024a9f1fd27929628bc9c121d685f73c5472c756c8260f0101269550ee4708d370186472c01ba80a76e9220d1ce763f43725842e

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\parseurl\package.json

                        Filesize

                        1KB

                        MD5

                        5b1493bd775444f0994d0b1063db1900

                        SHA1

                        646dc756ff16c464fcb63e17b2cd5ee4ad4f8b66

                        SHA256

                        98c7b953c844cac7c0be2d5abc6559c6fd3a6075fd159b04c0f1bf46145bfed2

                        SHA512

                        5be5ba8e172d288fd8f66dd3afcfae75d9f48d7fed3648bc34b4901fcc3f6ecca59ab7d6a73fda298dbad33a372d74c083696e9169e6a6485e7bc4b166fae318

                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\statuses\package.json

                        Filesize

                        1KB

                        MD5

                        210cda9d522bab0911dff42346dee4be

                        SHA1

                        3328d9bfc82e4f981a1acd2f3f78c524bf85333c

                        SHA256

                        53bd1b14e481356bf004c0a45f9022d07fbc56bfe849115e141ba302c8818275

                        SHA512

                        8baf4a077586efc571b3b32c64dfde8a2a0aeb4ecea91e016ff96e40051c0de4e6c09cdb8c0711a2731a77120d9aceac0bf2077d0e14e28853fef90d512ab620

                      • C:\ProgramData\Solara\Monaco\fileaccess\package.json

                        Filesize

                        53B

                        MD5

                        b9f2ca8a50d6d71642dd920c76a851e5

                        SHA1

                        8ca43e514f808364d0eb51e7a595e309a77fdfce

                        SHA256

                        f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde

                        SHA512

                        81b6352bbabd0bffbc50bfcd0cd67dc3c2a7d63bda0bf12421410c0ec8047af549a4928b5c5c3e89ead99aa9240bddb461c618c49287c15d9d4d3a899e8f596a

                      • C:\ProgramData\Solara\Newtonsoft.Json.dll

                        Filesize

                        695KB

                        MD5

                        195ffb7167db3219b217c4fd439eedd6

                        SHA1

                        1e76e6099570ede620b76ed47cf8d03a936d49f8

                        SHA256

                        e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                        SHA512

                        56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                      • C:\ProgramData\Solara\Solara.exe

                        Filesize

                        133KB

                        MD5

                        5ac0462702a125b10cad429f1a29ebe5

                        SHA1

                        9a1f9e04fe156e929ef8edecaf9f11c7a5ee9ae2

                        SHA256

                        eb6c724328e344f63d7fd7207b89e7c192411d624e69d64859f282cd36bf5bb7

                        SHA512

                        f44af2ce1137bc7c8f9b54e605c6f08c0f1e56861d539e79bc35f6ccc724f8c5df15ba3611622172c21e57e19a2613cce132f6e3ab3e239fb5263b22b0add5aa

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

                        Filesize

                        280B

                        MD5

                        d0769225cb7c27ddc1916eb1772366ce

                        SHA1

                        68db8888e8c95eb93666f781dc0b57551a6515bf

                        SHA256

                        6d1204f4ee072234595a134f4c2512235822a3f4ff6e2d398faf0f10363cacc8

                        SHA512

                        f42afff6f563335161fe52728ce9aec048f6596693f36d40ad4f718a4562d64de72d39023a3b03847d7e8084153136a766782b644f1ef20219c1aad4e7210bb6

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnGraphiteCache\index

                        Filesize

                        256KB

                        MD5

                        5a854921cd15c9115f2815cc1020a8a3

                        SHA1

                        0bdaf2e76472c4d9d30abbc8f12cd24fbec537e5

                        SHA256

                        8ccee87d534f9507ddcf195ed6cc94ab9da239ca3ce749ed2faf1207c85f9cf6

                        SHA512

                        1dc5d7be74e6ca4fb50676eda5a5d0696753ddfb2735e47dbb24d664a5f9342d51ae73a49fb6e75464509c19a56431e2d5abe2e142d7c072c99d12133faf52a7

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT

                        Filesize

                        16B

                        MD5

                        46295cac801e5d4857d09837238a6394

                        SHA1

                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                        SHA256

                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                        SHA512

                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

                        Filesize

                        41B

                        MD5

                        5af87dfd673ba2115e2fcf5cfdb727ab

                        SHA1

                        d5b5bbf396dc291274584ef71f444f420b6056f1

                        SHA256

                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                        SHA512

                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        76cc951d3dccbe4acc4bd9110c914685

                        SHA1

                        6f0cae911a5971dc416144cb6e6d3df730b27cef

                        SHA256

                        d8b2ccd7fc1b5497228052c7eedb1580e7fa62ac386452cbda37ef7907db0cdc

                        SHA512

                        f2514b9773db352ba7160bb9e50038c7fc2aebab834f3d886a225197aa97286d9270cd50eb533bd8e1a1eeb47c4a0c874f037a0622bbc030d21b756eab1c1f13

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe67032e.TMP

                        Filesize

                        59B

                        MD5

                        2800881c775077e1c4b6e06bf4676de4

                        SHA1

                        2873631068c8b3b9495638c865915be822442c8b

                        SHA256

                        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                        SHA512

                        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        831b1cd0750802736cf5d68721855192

                        SHA1

                        2e0e48e6eea6d4e1692b2f506294942cce7a3254

                        SHA256

                        4b66acc0ece001ac6769b5c7b94f982b14dfdcd9e24be8958fbdc96397bb4266

                        SHA512

                        4f7121b706cce958ffebd7cec035c286a9ba0a9937637c66c17b034b2837181e892a9a3c2e661c4e08e203f1b3c540bbdc490ae6d4eb7d45d804f207e8132614

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\e0c20a5a-9a36-46c0-a5f7-f743d3b8cbcc.tmp

                        Filesize

                        5KB

                        MD5

                        1b1316d148038db8176109097076bed2

                        SHA1

                        77107745656de6325d490784bd91cfb69f401d62

                        SHA256

                        2f3dc9aa2fb6c36600b8c8f14cc87306b0c845b82dcec3545b7d6a23cb71b422

                        SHA512

                        cac08eda554e32c99784beb3afd5b15dae33b65b51a8f3bbe732894f8e6a40726b547d26c947eee97046ba056e00e9100e7cb10874be66e14ee6ee08ca449e0e

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_0

                        Filesize

                        8KB

                        MD5

                        cf89d16bb9107c631daabf0c0ee58efb

                        SHA1

                        3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                        SHA256

                        d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                        SHA512

                        8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_1

                        Filesize

                        264KB

                        MD5

                        d0d388f3865d0523e451d6ba0be34cc4

                        SHA1

                        8571c6a52aacc2747c048e3419e5657b74612995

                        SHA256

                        902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                        SHA512

                        376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_2

                        Filesize

                        8KB

                        MD5

                        0962291d6d367570bee5454721c17e11

                        SHA1

                        59d10a893ef321a706a9255176761366115bedcb

                        SHA256

                        ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                        SHA512

                        f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_3

                        Filesize

                        8KB

                        MD5

                        41876349cb12d6db992f1309f22df3f0

                        SHA1

                        5cf26b3420fc0302cd0a71e8d029739b8765be27

                        SHA256

                        e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                        SHA512

                        e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

                        Filesize

                        1KB

                        MD5

                        91fe77a02c4d092afe1c6d244eefb443

                        SHA1

                        707a13f63359f44bbae8037a4d3b8828a7b9e5b8

                        SHA256

                        802e76d610ba8fbfafb2d10196ec3187ccef8770e2cb0ab909e48efdf3bb45c3

                        SHA512

                        ca4c702eecadef4547a5b8985f774867d064c93f41a7c5a4fd4d96ef54db0db1262367abedef67e8ed14b8b98e97f67ec538b33379606657f8c308159e061184

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

                        Filesize

                        2KB

                        MD5

                        3b36caff4c9c64138fb145d1c1b26831

                        SHA1

                        183062427481f38103298d5aef854cc399e1e1e7

                        SHA256

                        48efd12e3538edeb576a9697d4523954338cc18486d23e487feeb2e54678d61a

                        SHA512

                        1092a92250eedb2e0a12ffcdd7b8c12a69fb1ff6c2545543035381e793d7ba0780f6c82c62cd2833ec828da69e3fec6084e1b5f5214cc8bc1cfe0f62da820fe3

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

                        Filesize

                        3KB

                        MD5

                        1b124ab5861604e5f4b38978edff5f64

                        SHA1

                        7c26e7cda1e9373efeb62a3eb1b48c730eeadda3

                        SHA256

                        d9e3a97770ab473593b946236f896c3d216aa2a64e4c131346fa8f8979858ec4

                        SHA512

                        2cd75c5601a5a0ca8677949dfadf12a5188d8617a10d3d9933d915a003db3c6c894fee678c165d589cf791dc4c4343fcd25ff227e51d6e9534f99e13ce04653b

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

                        Filesize

                        16KB

                        MD5

                        595e602ec43a124d7c2c6eb7acde3948

                        SHA1

                        b1a27b35e88d132a730e75efa8983d5c211432c3

                        SHA256

                        f3462cdcd222c36cffaee3cb403fb18dd7c96839bc454937a01981282b10f035

                        SHA512

                        909d83a11377bdec6fa37b5bed3d8d02606276fe059471299b096048080933ece3ba743e5b8d77f5c8a6720ea4452f6cb8206bec26c8f81ab51061d2f47cfdd7

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

                        Filesize

                        16KB

                        MD5

                        cd7adcf6c9193e96436f278b2064fa40

                        SHA1

                        0de16fbe8b7e008095e98431e3b041fee9660b6e

                        SHA256

                        c27049341d87fad886b2a10f10ba81549d226bb83edcf30aea4beb51e6410e9f

                        SHA512

                        741181c75233abfa2435fc69dee420862c79441016b0c538e42199edcdec032c5c6f9713910b0698ec378216624fa3e67466f7ebf33e368aed6a06a410bccaea

                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe668f75.TMP

                        Filesize

                        1KB

                        MD5

                        a920fa3460fd44d37d661f4108033e86

                        SHA1

                        5f25c618e85eeaebceb0d77c3ad3e31018385470

                        SHA256

                        866ce5e4adfc1915597e6f1b893b0fcb238cb936ed387f2df6a56624dbf638cf

                        SHA512

                        41dc6a15e09283091f28e80037f115afb7fc251a5c24c5a96d4dba015930685e3d6128882a39ad8b5731d609cebb5870e3a7f085691835c7864aff20e55d4f2c

                      • C:\ProgramData\Solara\SolaraV3.dll

                        Filesize

                        6.2MB

                        MD5

                        148923086251ba36d914e9f20b5b1f5d

                        SHA1

                        2deeec4a12ef59b187409cf09b7e6dc90a9cba19

                        SHA256

                        8f23085c5b3a524154893e1b6280dd7a905a720f5d58f10930a0dad649a7d2ae

                        SHA512

                        f5ee8a27f10466b0d6eb50759318fe81405a612ca02bdcaa9967b8fb2b373dc96dc321578d3d9ce5ef83e70ea44178bfb600b03d7bc607643457b70f197abbe5

                      • C:\ProgramData\Solara\Wpf.Ui.dll

                        Filesize

                        5.2MB

                        MD5

                        aead90ab96e2853f59be27c4ec1e4853

                        SHA1

                        43cdedde26488d3209e17efff9a51e1f944eb35f

                        SHA256

                        46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                        SHA512

                        f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                      • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

                        Filesize

                        30.1MB

                        MD5

                        0e4e9aa41d24221b29b19ba96c1a64d0

                        SHA1

                        231ade3d5a586c0eb4441c8dbfe9007dc26b2872

                        SHA256

                        5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

                        SHA512

                        e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                        Filesize

                        18KB

                        MD5

                        3747d4a0963f7a70621635d840480288

                        SHA1

                        d9c56e1c5dd93742401c0f1caf7a34fcff318824

                        SHA256

                        aeed6390216e4c22baa66e2d62bcd32657a5720c011335f4d71c38ee691ef23c

                        SHA512

                        2f18b983e0a4ad19379f952b67cf6af4bb6d93c5952abea8e7840e8e0b59a686febef2a7fee8085e57056e68acd4b1b2e88681088890c5283e498e6e366d2abd

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8Y4X6KQZ7D8KB7EIYH8Y.temp

                        Filesize

                        18KB

                        MD5

                        4e941671c0914a201f26db8b07d7ad0e

                        SHA1

                        b5706d18ce8776fcb11820a7b8ed138ea802787e

                        SHA256

                        e7db1769272c94cdf15af2c4dac34d307762c6f7abdbb10970234bbcb5affba0

                        SHA512

                        5790454c9c3f1b3ec8b8a1def8f187783ea42508fe05dbc3ddb6e78e1102240e4892b5758ccaa3bc5ed030ae21b6c58499519f3ec56c569d172fd0d66bb07549

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                        Filesize

                        7KB

                        MD5

                        d97c351d3e13fde18f51ba614b2b2fcc

                        SHA1

                        ef420c2cc034ca8f9658a7eec88e4144a5ed3796

                        SHA256

                        ac2dedaaba121af0e3fbe051af8b77f21b4811f6b9451b2b4e68a8dca7f49aa0

                        SHA512

                        e32c3b2b06a8b284cb8786b6e0a438534ecfceef635f58aabe45c623639fdfa20c82fdb771b88fce9e66edb0079e0d4047fbb3540c80c2b6be50bf182cfc83b7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                        Filesize

                        12KB

                        MD5

                        605eadd42b0e12438ca70d34eb621c81

                        SHA1

                        66151f6d3499699f27bebf1c59918f3567c1e09a

                        SHA256

                        8a9b1b83dd68f70a593a44961d3ccf93be723fe43d07e4670346ad9ea959432b

                        SHA512

                        b60ad754e2d39a00066dbbdd84affb9ac3f43516c4cf8f53e4f5c4a4018da885443c7a214c92697c4796e103b9a5b01d881816dbd93fdde29d1f424b34d6cfd5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        4602a47c09973a52cff0cdad2ad09187

                        SHA1

                        807a804641095d9dd1a951966ed135186b6e67b7

                        SHA256

                        068989d11d3b403f95c88422ad942af8e4a6070ee90b2cf3e6cea9fdbd312f47

                        SHA512

                        e0519fb711052dfee61283591e47c4b61d4e60ddc0f136d996c7a16c3d0e0fcd378e0048310fba4fd5eb8f663148f7dc008dffbd9b029b8553991ab174eec4f7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        6KB

                        MD5

                        f8384f16f478c2e2f9659ffed671dc5f

                        SHA1

                        0d7eab756dcb7fdd0d3fcf90abc58521426f9322

                        SHA256

                        3b9289f6cf688049ba14a8955e634aea4298e9e306a51ae1ec04dc67fd0ffea0

                        SHA512

                        9fd3bc80a71a30f8d2bdf943aba1faf0a2f6dbd2b6600a65ff7eef202c3e78cbf9c308a12e2137069d0cc7416943e8ebb63ea9183556f47540a1a3f49ebf4b19

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        6KB

                        MD5

                        c7849c394dc3d850bfd73b7bd8e61e92

                        SHA1

                        123adb9f21ea9a1eda9761c7fea7c01ca8648ddd

                        SHA256

                        5b7d098af1d9796d2cabe7526e2377468600feffb71e48f3473db06493f3d978

                        SHA512

                        b5e308f386cdc9ac3dcec058ef191e36a3a7f1724cb4a5c3263ed445f6ac480cb044eaf4164f9a881e8c8c97a6ccb2c3c5a5d2b69ff6544dd14a78300c589603

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        60KB

                        MD5

                        dd4834d59e62a46bda634e66acc77298

                        SHA1

                        d5e10eaf42e37a9d0aed9dfa617431e5885da4ca

                        SHA256

                        0e5bcfb286227f5c11925175f11a161d412724115aae03000308500a14bd8896

                        SHA512

                        5107d525f24347722c6ed59256da233f62ada88d0560fbfdd8a1f329d5958e5c38f29b657332183c87cf6fd3ac5020d7a03cd8092bb920eeff09caeecbfb83a3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        60KB

                        MD5

                        0cb8570f842e987edb158b4a2e5deaf6

                        SHA1

                        1817646eb1d11735af0268f3bf872da88364041b

                        SHA256

                        5a2b9d87109dcd4828abb13d451228332daf479328519443f743fdc6b94b175a

                        SHA512

                        7e0bc9f43d3d760300d12c800932cf742c105b018d3f1a3fe7200d0a148107b43f0d2a4a8fa83dc2ae536a899541826f9c86fff2157eb0c10291af848ac04612

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        44KB

                        MD5

                        fcc6dacc610c9cf2fb9aaaceecfe2fd0

                        SHA1

                        982fd9c35e13f71bc6bda6d7f725d3d5a23a2f42

                        SHA256

                        1ad60321693a037d487a30821b351c04709d70783af6e032b4d49c4bd882aca9

                        SHA512

                        8406e6c2e4b080c38349ad943c3a9d2b7de3cf6a538a7f35f8d09ce90351c656f41f2f8083db03bc6da3b9a69893717fcbce433a2a5734dd585e030f9d32eace

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\9f81c1a9-a0fb-483d-b0d6-72ff97cb60ce

                        Filesize

                        3KB

                        MD5

                        38177a4a95964cae2f80dae5f8e3915c

                        SHA1

                        c240b5e297b26107575c1a0d1af7b7376459ebac

                        SHA256

                        645b35dd1b6a220304bdce339429e08847851f51925e75f21ac3f0516992b95d

                        SHA512

                        09b34a501342422bc994d9fdb5c0e243a510e04bc470fd5df65eceb5731c0e3a94ddc2f1a9f4ac1debfd90af92f5916de61f42a75c4a73e991911b621df11871

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\b72948b1-e1e7-49bb-a551-76a442a6ff5a

                        Filesize

                        982B

                        MD5

                        81a55da7536ae8b4fd738c6458cec3f5

                        SHA1

                        a6f828fd55839cd4e32269bafb6df3e13a4c1dc2

                        SHA256

                        1c743e121a760105124e65ed30d64c2eff7dc4f2e0a73b33e7736c860d216f0d

                        SHA512

                        d88cf69b5895eee207224f05df9e1c1472b7e6efb223bd1e56f74db6b9e18873a8bd10d48a3cefbb45520a770554bd8bc29888af8d8718e95184b98a7fa5dfac

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\be986ada-2fb6-4bef-99d4-fb9f07183c52

                        Filesize

                        671B

                        MD5

                        7fbc73f8794eccf9badaaece2932e601

                        SHA1

                        a7fa98fba61556b058e8d021c4be4f0bb18acc07

                        SHA256

                        82907d8db2e297fe3bc9cb50301e18088825c476a8b2257bed5909dca4ca4ca3

                        SHA512

                        e97214abbbf637402966342109114b594226014a3b79225efe0190e3a0ad0c4ebee6e94d5b0fe33ce5d02b33e7df528815d2f0965596282f11bbb825734f8a08

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\c0e2677c-45e2-4360-9651-44c965805bc7

                        Filesize

                        27KB

                        MD5

                        051170f7aed200f08f1a7881ec80d7ea

                        SHA1

                        a54967d7a0c00ed5199b9dbe0ba6983215b46e1d

                        SHA256

                        d61246282326fe0047d0389244e1c141c1f9200139c2ba8c3d404d5b1166d26e

                        SHA512

                        1401c852b039016ee0f352f14fa15ec6125e6a9f1e11b5a31f24633b73a441e86efa9fe956298168c49fcb9ec3a835ce90d14c3aca02df7050c8b588b2312a7f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\cfc28fc1-c32e-4ab0-bf7c-dce75158ddb2

                        Filesize

                        847B

                        MD5

                        acbd1ce39967b1aa44f4327ab23ba0ea

                        SHA1

                        43eb71699a836bebdf939f523e1eae9db6b4d7c8

                        SHA256

                        ffd93a1376141edecff811290a830cfdd9adf4c8572b3571ee231640431b21fe

                        SHA512

                        5c44b9765d0ec5d19e78bde5ccd615ae5b7956d1a30450b1ede443f848930204540570af28534872f0726883b481711a85922b2fc4af73e6fe7332cb503baf03

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                        Filesize

                        13KB

                        MD5

                        cec321bf2e59989642668d51f34a16c6

                        SHA1

                        fa0f23c4ddf42a9ab8747f9dc9bb08ea6f8608a0

                        SHA256

                        dba200ff9648d644d1f9a998b5bae7bcf849ef4665154c3aa03c4a76fa8d06c8

                        SHA512

                        baa307e482473cd681794cc37f27e184e179ca24d4c05804096b7847b39923d7b34fb2495eee768edb8a7dcc1f987bd649d6df520dafc5e85e8567e6c53304f6

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                        Filesize

                        12KB

                        MD5

                        b2d10d23b4d05e6eaf7b5fc9aaf46477

                        SHA1

                        8a91cd34405b3aaabfb9be85ac4d4f234479038b

                        SHA256

                        04e35bf47e5ff18c23f11c1886b34b57a585a527c3f67c82f253da2f631707a0

                        SHA512

                        de13881d943036c300f7ceba39f3c46bddf07a20c48e466cdf8dd94893b2b214d7739f26697971fde4a68a4255338452892a1a5267d6e44cb8ff9c3fb1b01ad6

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        2b2f934d0f6e0fb7923cf13a9f9e1fd6

                        SHA1

                        2f70239db4cc1ab494100263346b4bfb3aa1bc0b

                        SHA256

                        9adadb62557dfbd1aaa32365939b1afdc5f033dce7e5179bcda98a081f715e54

                        SHA512

                        ee7ed1410718859f0082f1eede18d237fdb36d8ca5ad7c6f1741b261e4cd6930b81ff1e6d2842a0c87f03e6bee7121f0e602c32accfb18a75df24fcafd6ab732

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                        Filesize

                        12KB

                        MD5

                        d394e75fdb502fe64d2759a8cb43a6ab

                        SHA1

                        e4f28903bd076a4d10c4f1c0c19e4c7ee22bd788

                        SHA256

                        8a4c3722ba220ca4a828a6e8b453865c2f0c7e8f2207d4fb5bd2fcba5522726f

                        SHA512

                        62eed0b0aa29358044ad3a97bc5973852e1e67b706095167a0c3e845e21102ce787dacae56b6496393ca7647842e36b245b01781ebc88096df8a860302af887d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                        Filesize

                        12KB

                        MD5

                        6f1a9f07ce91a91f29e9ca2f41528d1b

                        SHA1

                        a35ec72d159d6dd64c83ef5666f9ef891c93d216

                        SHA256

                        d54c06c48f68e3b3debf9fdcac9930b9add6b53b079d7fbb58fbd3574ea57f6b

                        SHA512

                        890dde4887f760bea12246e5bf96fbc2e91565cea40ec57e6881caa91c22e410e091668add01a89b3660a62433f22138a7ea9ffbe95f8906b355c6bde942f05a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        3KB

                        MD5

                        c4987c4d5418d31ee4a1a4e1dd553c5a

                        SHA1

                        ed32636e6dbe969b43447d00bfc0a01dcd6e733a

                        SHA256

                        af6225d84ac756cca7f1314c304bff0706e5ea26dd9d814f491555a816b103e3

                        SHA512

                        1e52a2509e9ce8bb66e2cb0b6515a2ba8774f946611567f43fff2ec5790517484444a9cdf6eeeb735c7fdf868cc3a5cc4a45bf5d9c635cc67d87754202f1086d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        6f6a95d1b524555eaab23ce3f8ded91f

                        SHA1

                        1997e87afe07a897df5fd45a96fd9873e93a200b

                        SHA256

                        fcf2b21d287adc86d485d299cfae93f0a83eed14ca2b964a67b8b09fe2108b2c

                        SHA512

                        50bcdfc5ea7079328b6aeefaf9ae9dbfb85cdff975487fbc85b53af655897f102ad65989cb347f2960cde527c1daf0a19d777f4aea3751075a83285177a43b4f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        3KB

                        MD5

                        db87676ddea8cf8fa0b4e7240aed2595

                        SHA1

                        6c1a75e54001f79f40dd4ee6e7013b5a35e3650e

                        SHA256

                        bfdf9114d0fbaad1ad9822e48d69b4d5e494ae716f75156a94e09641a140b6d1

                        SHA512

                        5f8ad14fc669dae322d2265a7da6c617e7c05b08732b5fc171beb96f238cd8ea6ce6da46ebf588ad6b0fdbe9c13418fe21a1eea258d65422305631808e24d4b5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        e56a638dc6764e9bfd189d822e7095a3

                        SHA1

                        7944c710bf9895f77b3682e9ef999ed9d252fb65

                        SHA256

                        1e3265db1f0b31a89a8e00e274584ffb5ee1ad3be93ff307d03802829d74dacc

                        SHA512

                        52a77ada37679b8ba328a645577750c6ba3aee30bd0a66768ad03fc2a80f35b500b79d10715ec7b442d96c343f5fc39e6708c5b760dee9c9a0526e80d0414169

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        5KB

                        MD5

                        f6f8bbe305dbfe77625f56e9137ecec4

                        SHA1

                        c1865573f8b87b9ffd731a5c392a05a9a8f12c2b

                        SHA256

                        b954be47f4f40b8a9ce40ee1450daa8c45a69c6aa3ea2524a6a104e55adadd71

                        SHA512

                        4bef08b606f1a7403f69881d68f43be3466c090766c66fcf7ea08dcaa0d6bcb51178ad28d944413f581876f1789630710d7d154cbdda78d9046c33363320155c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        15KB

                        MD5

                        f32767f98059931d3fab3d9e53e74657

                        SHA1

                        4695ede5d94fad245c85b42f3f8db7e1c4419bc3

                        SHA256

                        366a1c009ef83080312df68e7ac130f53c2982535a551d7381c6af1580fc5d9e

                        SHA512

                        9d048c714e37f7096fc3148ac077ef0d0681fc519f484e811e16aca9e079813e15ce5a675ca3db1f9af646beea5b07b5e864b7e4d4e1ce9375c58f6d0c2c05c1

                      • C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.MYO4CQ0G.exe.part

                        Filesize

                        1.6MB

                        MD5

                        45e5ca74b9ae3c3fc6f6a63c609783b6

                        SHA1

                        f36715bea96d69bb18075fac30b90502c6d2464b

                        SHA256

                        b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9

                        SHA512

                        014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a

                      • C:\Windows\Installer\MSIED0F.tmp

                        Filesize

                        122KB

                        MD5

                        9fe9b0ecaea0324ad99036a91db03ebb

                        SHA1

                        144068c64ec06fc08eadfcca0a014a44b95bb908

                        SHA256

                        e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

                        SHA512

                        906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

                      • C:\Windows\Installer\MSIED8E.tmp

                        Filesize

                        211KB

                        MD5

                        a3ae5d86ecf38db9427359ea37a5f646

                        SHA1

                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                        SHA256

                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                        SHA512

                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                      • C:\Windows\Installer\MSIF34D.tmp

                        Filesize

                        297KB

                        MD5

                        7a86ce1a899262dd3c1df656bff3fb2c

                        SHA1

                        33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

                        SHA256

                        b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

                        SHA512

                        421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

                      • memory/624-3731-0x0000000074710000-0x0000000074935000-memory.dmp

                        Filesize

                        2.1MB

                      • memory/624-3730-0x0000000000410000-0x0000000000445000-memory.dmp

                        Filesize

                        212KB

                      • memory/624-3770-0x0000000074710000-0x0000000074935000-memory.dmp

                        Filesize

                        2.1MB

                      • memory/2096-2841-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2845-0x000002C9EBB40000-0x000002C9EBB4E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2096-2794-0x000002C9D0F60000-0x000002C9D0F84000-memory.dmp

                        Filesize

                        144KB

                      • memory/2096-2796-0x000002C9EBB50000-0x000002C9EC08C000-memory.dmp

                        Filesize

                        5.2MB

                      • memory/2096-2848-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2846-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2797-0x000002C9EB7C0000-0x000002C9EB87A000-memory.dmp

                        Filesize

                        744KB

                      • memory/2096-2799-0x000002C9EB880000-0x000002C9EB932000-memory.dmp

                        Filesize

                        712KB

                      • memory/2096-2835-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2836-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2844-0x000002C9EC530000-0x000002C9EC568000-memory.dmp

                        Filesize

                        224KB

                      • memory/2096-2837-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2838-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2096-2839-0x000002C9EB450000-0x000002C9EB460000-memory.dmp

                        Filesize

                        64KB

                      • memory/2096-2840-0x000002C9EBA80000-0x000002C9EBB10000-memory.dmp

                        Filesize

                        576KB

                      • memory/2096-2842-0x000002C9EB7A0000-0x000002C9EB7A8000-memory.dmp

                        Filesize

                        32KB

                      • memory/2840-3763-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3373-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3775-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3780-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3784-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3789-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3792-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3797-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3359-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3355-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-2850-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3831-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3834-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3839-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3311-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-2851-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3766-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-2853-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3568-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3771-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3236-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3377-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-2867-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3384-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3398-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3729-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3476-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3541-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3549-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-2852-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/2840-3222-0x0000000180000000-0x0000000180FA6000-memory.dmp

                        Filesize

                        15.6MB

                      • memory/3044-2383-0x00000248D5E90000-0x00000248D5E9A000-memory.dmp

                        Filesize

                        40KB

                      • memory/3044-2380-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/3044-1983-0x00007FFDD9FF3000-0x00007FFDD9FF5000-memory.dmp

                        Filesize

                        8KB

                      • memory/3044-2385-0x00000248D5EC0000-0x00000248D5ED2000-memory.dmp

                        Filesize

                        72KB

                      • memory/3044-2789-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/3044-0-0x00000248BACA0000-0x00000248BAD6E000-memory.dmp

                        Filesize

                        824KB

                      • memory/3044-4-0x00000248D53B0000-0x00000248D53D2000-memory.dmp

                        Filesize

                        136KB

                      • memory/3044-2-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/3044-1-0x00007FFDD9FF3000-0x00007FFDD9FF5000-memory.dmp

                        Filesize

                        8KB