8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
597s
max time network
599s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-12-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperV1.23.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

7^/10

discovery themida

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	BootstrapperV1.23.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	Solara.exe

Loads dropped DLL 11 IoCs

pid	Process
3828	MsiExec.exe
3828	MsiExec.exe
4680	MsiExec.exe
4680	MsiExec.exe
4680	MsiExec.exe
4680	MsiExec.exe
4680	MsiExec.exe
5020	MsiExec.exe
5020	MsiExec.exe
5020	MsiExec.exe
3828	MsiExec.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000045edd-2816.dat	themida

Unexpected DNS network traffic destination 27 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
35	4600	msiexec.exe
37	4600	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
52	pastebin.com
53	pastebin.com
122	mediafire.com
124	mediafire.com
125	mediafire.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\util\tmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\actual.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\node_modules\brace-expansion\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\min-version.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\system\has-flag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\verify.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\query\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-regex\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\agent.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\release-notes.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\place-dep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\dump.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-diff.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\vendor\QRCode\QRBitBuffer.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\key.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string_decoder\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\agent.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-search.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\configuring-npm\package-lock-json.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\cmd-list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\copy-file.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\find-dupes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\mkdir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\yallist.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\polyfill.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\table.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSUtil.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\with-temp-dir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\clone.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tootallnate\once\dist\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ping.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\link-mans.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\unique-filename\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\parse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\columnify\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-node-modules.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\destroy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\timestamp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-hook.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\deduper.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-restart.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-fund.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\index.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\lib\body.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\completion\installed-deep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\events-once.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\gyp	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\retry\Makefile	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@gar\promisify\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\cjs\index-cjs.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\color-convert\index.js	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1855.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI471F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18C5.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D3C.tmp	msiexec.exe
File created	C:\Windows\Installer\e581306.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2684.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4682.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e581306.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI26A5.tmp	msiexec.exe
File created	C:\Windows\Installer\e58130a.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4816	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1296	WMIC.exe
1296	WMIC.exe
1296	WMIC.exe
1296	WMIC.exe
1564	BootstrapperV1.23.exe
1564	BootstrapperV1.23.exe
4600	msiexec.exe
4600	msiexec.exe
2856	Solara.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1296	WMIC.exe
Token: SeSecurityPrivilege	1296	WMIC.exe
Token: SeTakeOwnershipPrivilege	1296	WMIC.exe
Token: SeLoadDriverPrivilege	1296	WMIC.exe
Token: SeSystemProfilePrivilege	1296	WMIC.exe
Token: SeSystemtimePrivilege	1296	WMIC.exe
Token: SeProfSingleProcessPrivilege	1296	WMIC.exe
Token: SeIncBasePriorityPrivilege	1296	WMIC.exe
Token: SeCreatePagefilePrivilege	1296	WMIC.exe
Token: SeBackupPrivilege	1296	WMIC.exe
Token: SeRestorePrivilege	1296	WMIC.exe
Token: SeShutdownPrivilege	1296	WMIC.exe
Token: SeDebugPrivilege	1296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1296	WMIC.exe
Token: SeRemoteShutdownPrivilege	1296	WMIC.exe
Token: SeUndockPrivilege	1296	WMIC.exe
Token: SeManageVolumePrivilege	1296	WMIC.exe
Token: 33	1296	WMIC.exe
Token: 34	1296	WMIC.exe
Token: 35	1296	WMIC.exe
Token: 36	1296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1296	WMIC.exe
Token: SeSecurityPrivilege	1296	WMIC.exe
Token: SeTakeOwnershipPrivilege	1296	WMIC.exe
Token: SeLoadDriverPrivilege	1296	WMIC.exe
Token: SeSystemProfilePrivilege	1296	WMIC.exe
Token: SeSystemtimePrivilege	1296	WMIC.exe
Token: SeProfSingleProcessPrivilege	1296	WMIC.exe
Token: SeIncBasePriorityPrivilege	1296	WMIC.exe
Token: SeCreatePagefilePrivilege	1296	WMIC.exe
Token: SeBackupPrivilege	1296	WMIC.exe
Token: SeRestorePrivilege	1296	WMIC.exe
Token: SeShutdownPrivilege	1296	WMIC.exe
Token: SeDebugPrivilege	1296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1296	WMIC.exe
Token: SeRemoteShutdownPrivilege	1296	WMIC.exe
Token: SeUndockPrivilege	1296	WMIC.exe
Token: SeManageVolumePrivilege	1296	WMIC.exe
Token: 33	1296	WMIC.exe
Token: 34	1296	WMIC.exe
Token: 35	1296	WMIC.exe
Token: 36	1296	WMIC.exe
Token: SeDebugPrivilege	1564	BootstrapperV1.23.exe
Token: SeShutdownPrivilege	2908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2908	msiexec.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	2908	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2908	msiexec.exe
Token: SeLockMemoryPrivilege	2908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2908	msiexec.exe
Token: SeMachineAccountPrivilege	2908	msiexec.exe
Token: SeTcbPrivilege	2908	msiexec.exe
Token: SeSecurityPrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeLoadDriverPrivilege	2908	msiexec.exe
Token: SeSystemProfilePrivilege	2908	msiexec.exe
Token: SeSystemtimePrivilege	2908	msiexec.exe
Token: SeProfSingleProcessPrivilege	2908	msiexec.exe
Token: SeIncBasePriorityPrivilege	2908	msiexec.exe
Token: SeCreatePagefilePrivilege	2908	msiexec.exe
Token: SeCreatePermanentPrivilege	2908	msiexec.exe
Token: SeBackupPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeShutdownPrivilege	2908	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1104	7zG.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2680	1564	BootstrapperV1.23.exe	82
PID 1564 wrote to memory of 2680	1564	BootstrapperV1.23.exe	82
PID 2680 wrote to memory of 4816	2680	cmd.exe	84
PID 2680 wrote to memory of 4816	2680	cmd.exe	84
PID 1564 wrote to memory of 2604	1564	BootstrapperV1.23.exe	90
PID 1564 wrote to memory of 2604	1564	BootstrapperV1.23.exe	90
PID 2604 wrote to memory of 1296	2604	cmd.exe	92
PID 2604 wrote to memory of 1296	2604	cmd.exe	92
PID 1564 wrote to memory of 2908	1564	BootstrapperV1.23.exe	95
PID 1564 wrote to memory of 2908	1564	BootstrapperV1.23.exe	95
PID 4600 wrote to memory of 3828	4600	msiexec.exe	98
PID 4600 wrote to memory of 3828	4600	msiexec.exe	98
PID 4600 wrote to memory of 4680	4600	msiexec.exe	99
PID 4600 wrote to memory of 4680	4600	msiexec.exe	99
PID 4600 wrote to memory of 4680	4600	msiexec.exe	99
PID 4600 wrote to memory of 5020	4600	msiexec.exe	101
PID 4600 wrote to memory of 5020	4600	msiexec.exe	101
PID 4600 wrote to memory of 5020	4600	msiexec.exe	101
PID 5020 wrote to memory of 396	5020	MsiExec.exe	102
PID 5020 wrote to memory of 396	5020	MsiExec.exe	102
PID 5020 wrote to memory of 396	5020	MsiExec.exe	102
PID 396 wrote to memory of 2212	396	wevtutil.exe	104
PID 396 wrote to memory of 2212	396	wevtutil.exe	104
PID 1564 wrote to memory of 2856	1564	BootstrapperV1.23.exe	106
PID 1564 wrote to memory of 2856	1564	BootstrapperV1.23.exe	106
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 4400 wrote to memory of 2380	4400	firefox.exe	119
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120
PID 2380 wrote to memory of 4960	2380	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DD70EC91CF95A994043312A53A77D528
  2⤵
  - Loads dropped DLL
  PID:3828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9F05E93CF156506CA3DEE1B10A7A5225
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8E31E1EF76EC62907E242572E66EB967 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:2212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap6194:1014:7zEvent28506 -ad -saa -- "C:\ProgramData\Solara\Solara"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1896 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd287950-f71c-4a61-b4db-bd316fba8f77} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" gpu
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {036ffd49-241d-4bf4-b615-efa2d1172907} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" socket
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 1516 -prefMapHandle 3116 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ffeaf36-0868-4854-90b1-3184102db3f1} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 2 -isForBrowser -prefsHandle 3760 -prefMapHandle 2656 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b0b170a-fb0b-4bcf-b333-2a04c7de8084} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4804 -prefMapHandle 4728 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79c45673-df4e-458a-97cd-6e6d7b45ebfa} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" utility
    3⤵
    - Checks processor information in registry
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 3 -isForBrowser -prefsHandle 5468 -prefMapHandle 5472 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64160996-7129-4d1a-84dd-56caf1cdef6f} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc6265f8-d641-4648-9029-2a078ceb3179} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5816 -prefMapHandle 5820 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b18a047-1444-4fa5-8dd3-7ddba622fc93} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6336 -childID 6 -isForBrowser -prefsHandle 6328 -prefMapHandle 6324 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f655e706-2772-412e-a03d-04161aadc746} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6240 -childID 7 -isForBrowser -prefsHandle 6244 -prefMapHandle 6252 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52392b5b-10f9-4432-aec8-198b3cbe01ea} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6708 -parentBuildID 20240401114208 -prefsHandle 6252 -prefMapHandle 6632 -prefsLen 29279 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f9399ec-b3d2-414a-9186-0970f82a7889} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" rdd
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6324 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6540 -prefMapHandle 6736 -prefsLen 29279 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fa12479-ba35-49b4-8bbd-e3d9aea766ad} 2380 "\\.\pipe\gecko-crash-server-pipe.2380" utility
    3⤵
    - Checks processor information in registry
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e581309.rbs

Filesize
1.0MB

MD5
fcca22c009f70b460f89a81426191463

SHA1
3bec72698a0ecbf845b23c3ee4b660f151b55a1d

SHA256
e81e0dbd151a7e80fec2cf8fe7d5377f26ac9e62a9a82f456816961652ca8d7d

SHA512
a8b621b76adbf2000410d49e3cc9dc75765d4f9ce92f29080c33d3e5fcb17143f62b05fbd6c27187ae59dfa26ea4fc3ae8eec12ba52e51fff981ec1535926200

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll

Filesize
557KB

MD5
b037ca44fd19b8eedb6d5b9de3e48469

SHA1
1f328389c62cf673b3de97e1869c139d2543494e

SHA256
11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

SHA512
fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

Download Submit
C:\ProgramData\Solara\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
c7000faa6c6040188c8cd8ef28b6deda

SHA1
07a23c50092e5c1fd9c9df87e26b65df25d37b24

SHA256
e4f695b72f99024e3ee5d5f26a367e664f4e120bd5d90aa87a8bc0509c365ec8

SHA512
eaee01031477454823974546055965df8d75c5115b25ab07b15ca608a20e8c21154ebb8c707a74213ebad04c2bf34a5f5563306e6da502235372c60672144022

Download Submit
C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll

Filesize
50KB

MD5
e107c88a6fc54cc3ceb4d85768374074

SHA1
a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6

SHA256
8f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8

SHA512
b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe

Download Submit
C:\ProgramData\Solara\Monaco\combined.html

Filesize
21KB

MD5
b728677b0493784dc96269e36d7b41da

SHA1
e561d40c09944fb8030a2f9ae2b267266dc4fc02

SHA256
c730f0f0ddc0059064501b17dc3a655a6587a6fdbcdf1fbd732f390fff58b254

SHA512
ffe4914ce273828b208a579d6d0224769ed10e11e1bc0c415113379528e9b6877f39b85e99a9729fbad87e5a6fc50e221559c2e01541f3ff6bd2d60693e3361c

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\index.js

Filesize
6KB

MD5
0e709bfb5675ff0531c925b909b58008

SHA1
25a8634dd21c082d74a7dead157568b6a8fc9825

SHA256
ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67

SHA512
35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\accepts\index.js

Filesize
5KB

MD5
4fe4d2c90a2fd19d6e97443a7d24f815

SHA1
282263f45f6bf80fbf43f4097d53b5b60ff1a05f

SHA256
be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1

SHA512
c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\accepts\package.json

Filesize
1KB

MD5
32a15d6909fcae63e52d8664593d32d5

SHA1
131ba4d63747e6663a9c19409e43ac034bd532cf

SHA256
e5716d5d939db08c5c28ec6ae86ed67be5320f91089e2673fca1c5b876e57aa3

SHA512
6f0e9fe3d034640b8b2f902a5e336b39d818cec504a9c52767f5f08d71bb1903b182771625c110f768a8cc540b071a54afb7810270a09f4edfe5e35dba22fe37

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\array-flatten\array-flatten.js

Filesize
1KB

MD5
4b17fa06c54846b686b8b799e9dd253a

SHA1
fc6cc30e8b8ec09eeba62bac076ed627aa3ee8d1

SHA256
766ca145b6d25e3d60f352a716e8fa1876bcdf362c0767c360cf24f335bc281e

SHA512
72df1668f464f6942c484155b667086bb6f83f77e826ffcd146ee045079db3334aba270bffb66cdd796d4c9308121ec2a67a404289f19914c45d9a6c15435e71

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\array-flatten\package.json

Filesize
879B

MD5
cb1aa7f817100a03395dd0163bf6ebe9

SHA1
fc51b89d0fb7cc640a0495baa4005364e83718c3

SHA256
5c5e0e10cfa23f163d1fe68aa57a881d09cac39d720e1361c697b86c4d33e0f5

SHA512
81ffee7b54b11b42aaeeaf1b6fb13ac64e8900e94ffd249fe075c183c3adf8e8451529d82f6a13216c73e5d1a1f57d703d9fcf1e61674020d93b15066d37dc75

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\index.js

Filesize
2KB

MD5
b9e991c0e57c4d5adde68a2f4f063bc7

SHA1
0cb6b9eb7b310c37e5950bbcaf672943657c94b5

SHA256
9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241

SHA512
3bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\lib\read.js

Filesize
4KB

MD5
c148bb38c59ce266e271c96ab1f2d192

SHA1
027f3fbd8a5370ddec744d33ec9d594db41f6293

SHA256
1e9e274755366c39ae70e8b9a7a42fc12219566e67efaf9b7ebc2a8b337f5b6b

SHA512
bc4779cda1a3b130eb8cf76bb40676046ceb514ddc5c1891d7324776e6188e5d5ceb4c0799cf2fbc007786849ed07903cb59f61ffcac407300eef0a16cb7c498

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\lib\types\json.js

Filesize
5KB

MD5
6b036408f968978bf9668496db9953ba

SHA1
af1f14428152576f1c047c3462d26a7feb98635a

SHA256
44f8b529333004e2aaff6db3a1dbe7068f1ac5fa1173e9634686a78c2262af35

SHA512
89bef97d3d5d0c8da0f3aa1e178fee1d04eee5200c2f037bd55761a61e6c6a251f7314e82343761ef227a997909f4a0237a3ff5f79a1a7bb9e879a465ab84f86

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\lib\types\raw.js

Filesize
1KB

MD5
acb38e4fe575afaf8d1a257e47c6e362

SHA1
ea7411ff5a71df8d426322d07103e5894630e29b

SHA256
4e9cc80a7ee8bd667c68c264b4c374b28e731246ddb6ec22c3968daf837e30a2

SHA512
157427ad25390339b045b9bb81753709498b69b2cc8b9c918c19d52d1cb4f6bbe5b6b07885d0a7f66ef359b7080dc9a42216f71911b08ade04c1a112192bff50

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\lib\types\text.js

Filesize
2KB

MD5
beb4ada09306f8d6435566d9e88076d3

SHA1
eda9bc036c9d10f1400cd2e4a8832949671cadc7

SHA256
54a6e8ef720b06a300b21f6c60387805dec743a64154784a609dfe8c6860776a

SHA512
5d9c9c6837b9599d29db9b1eb54cd2a4e215feeb028137f31c20f2b02e38f600aa8c02721444dc41d7bfc206ad39a810076853d09fa1e3113b5708a75443131e

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\lib\types\urlencoded.js

Filesize
5KB

MD5
906a833480ce8841bfa5aeb95b5c085f

SHA1
8f74a7d616bf363b78844d3bcc2f554d7c76a952

SHA256
752717d87aad57451638af2073b04eba964f348910c0bcf0070c43e732de5eb2

SHA512
7676871dd3012dad0472be51698d9d1677622ba3d392417a41d22ef7f6d7df6c8085516bb9bdc45d4f125815161899aa889d756d18cd41f11e2402e659f7934d

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\package.json

Filesize
1KB

MD5
826bd4315438573ba1a6d88ae2a2aa65

SHA1
3e27986a947e7d10488739c9afb75f96b646c4c5

SHA256
0fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956

SHA512
2e98ba8e57cb0950e45d20365d16e86ad94a60cfd4cf103b7d55dae02de677985d37c0f771e16ae0a628cb3b59adce8a9e1742cffc298f18cb7d935d72536e6d

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\bytes\index.js

Filesize
3KB

MD5
83cf8fe86424252c5a9a3e2fe90dbd57

SHA1
bd46529e5637ff1a659f1d4af2598925b12741e0

SHA256
893fcbbbe962dc00e40dc2e4b20e76e92d874dd257345003c6575d940e91a37f

SHA512
f0630152a247cf51dfc677c22323afccc667350a11db093b59b93f403481deba1d44cd78cd53f4c4a3e2df297c35fe54cdc841c10c4667ebb81d3a54fbf56d43

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\bytes\package.json

Filesize
959B

MD5
5e3137feec27c5d88693e0cb2ff95d3c

SHA1
d8fe3e70eb4ecf4bf58385e4b27f89b7ce656a28

SHA256
99b21c09ce812dc76a06cd87c4753247cb9615c6a8501c5a5a9d9caa22ea2d12

SHA512
4b4d89317e1a1caae6924f234b75e15bd2f8bd026d316152e6cf3ffac53553bea2995076a8a365f26a96730f36170d115ac35aae6d0888f621f536d795b89a2d

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\call-bind\callBound.js

Filesize
413B

MD5
fda064fefaeb89252271922954d69a4f

SHA1
7bac1561b456a282abe97cb9bc4e5e0d8a10e769

SHA256
2b2fce7622fdd680256d28bcd59c30913546a825bf69d754d21a1d21ccc2928c

SHA512
b0746c9dc90bb513e7d6190470ce0acbb0c2059b97184b9391f581e9a490729669c8479ba8eaafc1980f4e058a396bad11031d048387b5223a7b4b9e6a4b1dae

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\call-bind\index.js

Filesize
1KB

MD5
40109fa1aade9c89c9587e77011f7301

SHA1
91f8eaf2fba5ee5c36e33207feeceee846c3e04a

SHA256
6b4ea26f8ca351cee55da416500ffca72fdb14eb5909f1512ce8ca68e47d7621

SHA512
d308a91b496c9fbd2db7d8b907d660142172342e990755093d892cf2b8382504119593bb83882f37db71e925803c37b9b098edc748f09eb6dc3f84b8dcc28f9b

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\call-bind\package.json

Filesize
2KB

MD5
7327c5e04c116460b3c73ee92292269a

SHA1
106489d54a0669a5271c89f87f2072cfb8e66c4f

SHA256
e8fc7600526cc041bfcd3a562e6cfdb53952a7f7fb4fcc899949e4c51c586155

SHA512
93f2327154e59b1f6fa2f55659fd5a8bae1da6cb4dc2ea5ef736ed6abbcbb2840286be9346bea22a3dd52371ac842870bd388dcc1e5b673696bc0cad868422d8

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\content-disposition\index.js

Filesize
10KB

MD5
43a307ff7de26dbec523ec966c434f94

SHA1
ed7f187b72a7b1f81d113bad5aa9347c242120d5

SHA256
e86a88a5d1a9dd74faa753ca4e47a78e38ae930f3206e5e887cf6cb0ad70cbf8

SHA512
79c073d3f0dea6c1606029b9a476cdce30ebbfb7b6ca95935a2e3f2cc97e70f3f00dbe8b7067beea78dae120f4941e60a7aa26592cff18e5cdf56f335127092d

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\content-disposition\package.json

Filesize
1KB

MD5
5b285d4db057e7e72225e8e928d2ffa3

SHA1
1b871ffaefe2a1fd69aa9b1538b4003bf0eae9ab

SHA256
2459c0e8fbeb5716ab06e9ef73747bba46ed2bc52e310bd4e9f0ef1f102da61f

SHA512
dfe71ab6bcf40f32a26273a94f11439cbe3066bc3216061ee6ea9737d57b1cabf03a0e45b2fc50c4d0097a27e09197c7fd2b60090a91876671d2c709f31a29a4

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\content-type\index.js

Filesize
4KB

MD5
4781c7ea0309edac61c3a36e3ea9da10

SHA1
1b6e7e8d1963ce958cf0f225223fadb5ef12f86d

SHA256
7d76ae0f8ecc0a8c053de97b0f695f3fa3df33f692d1bd241307995304e5f63d

SHA512
d458f8962f44ec30bf519a54aef063960d9cac2a954493383fc2ef46781c3244740f18c7daf1821b4e0babbd56b356228f7247ce40de9f3276de91a71c66c78c

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\content-type\package.json

Filesize
1KB

MD5
0de0482c40698c075e13e4d54ff34466

SHA1
1545c6d8538d7e59f375d4ae4b0e0d10471a6c1c

SHA256
bd78a5427ffca1966621301edc6cac2146c8c1e137f122161ba90dca7ec89f77

SHA512
9f32408067afa748af8d23b4bbbe2657e566017435d4ead1e63b6d12f8bebb671ea82353a302340bb6f1ccd4852a3cb8ed340a3a8af9cd058bd36653b3cd4bcb

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\cookie\index.js

Filesize
5KB

MD5
db5deda6183845891fe9b5667cde042d

SHA1
ee23ab87c951b0d3e3cdf1d6072a126a84491335

SHA256
9fd02358eabdf6c27b388dfdff94061655620a352253bfc5b01ee4cc30ca36b5

SHA512
1b6957f2ef28c5d4e14e02e8d6fea08d7210c0f2eb9de4788799fcc57d806998448622145ca45f0f605db447d97be982c62211535bf421d8c02d9e384e7db339

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\SolaraV3.dll

Filesize
6.5MB

MD5
586f4e3d23c70be3d75eb162d17077dc

SHA1
3c9866622650e05056ef4c09861b592ae6b35b6b

SHA256
3064efb20ca3946e1279984ba04ea234bf2fec03fc32dee995f421c794656fa9

SHA512
41b892645e2e35946a9827386b5767c0e7193d30f0610e992b1851c08a0d3f0505d6ad7356bd0a0a6c23a65fc15443bdc45341f026217b63c112538a75a3b21f

Download Submit
C:\ProgramData\Solara\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\ProgramData\Solara\bin\DLCTBL_FRTS

Filesize
129KB

MD5
d4f0872c73cb3f30d865c23b44d4e625

SHA1
b22a706ce3ead2bba4626b4300f0bdcd2540d183

SHA256
549d20fadb5c8dcde41512613c7f5002cdbff055d8e5bbf20d5a8ba4e273ddc5

SHA512
764933506de1e6c0357b77f029849077e91c910035508ba002758a7b6865c0a467552206bd5fa272fdce34fdd57b7e9e89ed3235191757ae17a975797390440b

Download Submit
C:\ProgramData\Solara\bin\path.txt

Filesize
34B

MD5
0e2184f1c7464b6617329fb18f107b4f

SHA1
6f22f98471e33c9db10d6f6f1728e98852e25b8f

SHA256
dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb

SHA512
8e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37

Download Submit
C:\ProgramData\Solara\bin\version.txt

Filesize
5B

MD5
9f5efbc54ce6010d54a11d1d81613fc9

SHA1
2b92f99ef7544df1d9624c1b3add301be5058cb7

SHA256
16d8f548385363784322b1d4fe4c176eb5fef5c341bde1666b92c5a95690a71e

SHA512
4291c74ad32ebcbfa90d95c47d788ba98d62afb145f727de69de8d0e7cff827fee49580b79eb46fce211e2f2405daeb5526fe55599f30ba5e42bead892666954

Download Submit
C:\ProgramData\Solara\vcruntime140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\ProgramData\Solara\zlib.dll

Filesize
663KB

MD5
c5b29a2e334961e9dee00ab4726392e3

SHA1
8f2043d03d0ff96a27cfce297f594afa87e79f2e

SHA256
57d27814f4d95618584d26c8e37418b9dfe3f28423de6265f4c17de7948e69b9

SHA512
0393b0506ada43f7f7978c2f81da62521b3c0a43d04242676002da755bc51ea144047891b6ff3796e89b4079360ffb245793fed67e3741b4c3884cd48973a63f

Download Submit
C:\ProgramData\Solara\zlib1.dll

Filesize
113KB

MD5
75365924730b0b2c1a6ee9028ef07685

SHA1
a10687c37deb2ce5422140b541a64ac15534250f

SHA256
945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

SHA512
c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
b61af901e3664d43c5476ddb12e75fec

SHA1
fb0a0969f66649d4e0d271cae35fd21472fd79bc

SHA256
8d91514e32c87ba1f0c8cf756ea7b104237827e05b3cb19495922f78a8947282

SHA512
92a6c4d7ca2be59161621beded2419364ba975a6136a6340e7366f12f557b244cbafba42a8a37441a2d5f110e8adc915066d229e15fd706b10c1d72d0a790b6a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\cache2\entries\016DC627F08DBE54AD2364A3DCA4F9E1DD04CFA8

Filesize
61KB

MD5
0af527c38d742cb086b86ce007b446a6

SHA1
382251602e5651595adefaa221cbcc5235ef74a9

SHA256
31e3fb933a66c1b9f3a66576284b51bbd43d6dbaad48cf4a7b5c08c20bfe687d

SHA512
191d3c00290455cabfe143ae983ba64c4756f0adfc0821c2fd8b23b113a3f7b41805ebb3c44592d245017255ff76ba342f9bf83cc7a4848f4230a48b37c686f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\cache2\entries\1966B825A708BB7F4D49B673500FDD919C82EE02

Filesize
224KB

MD5
36d6ba6b4f5fc189463067d0917607ec

SHA1
2fd1aae88faa6c510492f1add7b330b5ab23128d

SHA256
5442ed2533b7adc006fa4e1ceb545cff3df032cdcd4ff51cc21c7821fa65f72c

SHA512
0e51643b54fa5ebf8e968e90ab243fe91745728d4745652ea8bca718605cd622a56a126a85a7d3b838317e3e7b72e30cf43cd28a252ddcb4a8037f28822efa54

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\cache2\entries\7AFC97F9CF4BD616504FB893BA3523594331F6C2

Filesize
49KB

MD5
0aa4d4b7f424c11b4c06a757a0d17b4f

SHA1
6e5f714d3c2c96686c2b80aa4e9df55c9821e616

SHA256
1852cf15d104735a4e93f540b1c281d37d00c99f8ea2b274a8f16ec4e37c40e2

SHA512
0bc0c0bfc34951df4eff5b43e47bc749dfdb932cf7773b41b903cbe74dc626e84f3738e41fb314d0faa87da6c813398cc05b8e56d900fc1363c363c1a02b6c15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHMR99XYL2IR4349KS6U.temp

Filesize
11KB

MD5
695711bf48365b52efce73188473f9ed

SHA1
00d4ba85074f6d7786305dde8ade6e1b828c75cc

SHA256
c9f7fb6848ccf32886cabb1877aa37bafc559a48e1453a7a709d34b7dfa0b18c

SHA512
a6970cfdedd4a88b44db8c44018115a6bf1367e03192dc1d1d356f2e49f577099fc226d53f3f419d8d97035f27ee8c75083b9144d4760d2da4477367842fc68e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\AlternateServices.bin

Filesize
10KB

MD5
6c06ea6ba6e7878fef9b3ef65ff838d2

SHA1
822f1a2ea8ab05686b66b0edb425b53426191dc6

SHA256
22deb3b5e338c4273d6c2ab2ceb9c3d4d33ccfa177aea90931570659f214eca4

SHA512
e882c2599e727748ab737814be05186d5e4a4e0c96dc5a7dc1280f2abb969ce12dbc810562dec82b3e12de762bf6b68dfd26904b3039b8f735647e5b38673da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\AlternateServices.bin

Filesize
26KB

MD5
afabeadc517056a09bb94808d36987fa

SHA1
e91ee4712eaef53f87f5fe835d34418f4cd5e1f3

SHA256
83a6170d8299e4db5bb5d83d45c000f9e493c9ac2ec0accc02124f519df4cd00

SHA512
59ea320a93a06140297c0227f779358b36701eaf43be6019033e37b638ebbe7f81c448c60d330f40296c88f15a901b9af212d63d8ee885bb862a85efcd16bc0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\bookmarkbackups\bookmarks-2024-12-08_11_YUdqwbmsuRJmM1KIep9vcQ==.jsonlz4

Filesize
1005B

MD5
2cc2ae417472d2ed539aca0c6796464f

SHA1
f2bfd2b475e9f64b171d961721c2db968f63a5c7

SHA256
2f71ccdd3353688b03d7c0b0298b7b7a31907cf71c415e2eb48bcb1e755a4156

SHA512
de9a8b0e743809c787cca824630035d8029dcc83845a23bc6adaf286d348dabb580c91487c0b78a75dec8ef9e21a68cee173115b84b4f92e4730910c4e166d14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
63cd79620b29221caccbef10c9e097c8

SHA1
e0d4f75f846f1b7d392a7fe8212272f91ebc830c

SHA256
ad76cd4415a5cf755e32ce77c8bd78dc6443062631007c0510c36fd62954fcfb

SHA512
27e5dd58b067fdb60bd9212da48d2efe193cbdbfb16b5793693395acc1509fd8d84ab2271c8777718a5fc706410296e823e8d5c8c1385f631df7e380eaf2f465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
75KB

MD5
e42e3215cd6895e97a7d3148e47bd977

SHA1
2a5cf76ae5e624ad4182ff2ae568a1a7a40ba9bd

SHA256
9b263a97898badcc64a0a071e243e1e9521764a47e6e7d978c8e32ebbf1adcf7

SHA512
70463e569d647bb0fd45b8a43c20fcf022b3a5e2f3d6120e51252330fbd2a331dfc3bfbf62be9929dad3d779369f57143f00a6d3e3c60ed1349fab3fbabdc5db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
62KB

MD5
c41abb8bda9a84edb9fde923839e60b7

SHA1
b00a6e840ae251a9fe5558e7dd517baac9507256

SHA256
38dc56ffe434009d609e34a3d5a8f07338707a19b0f50a9cd5a0b317c54ebb85

SHA512
48bf5dd7bf17289286ee1c87a574f12d177d4064a051bf49ca5ca1d8c7c12201dd776c5561dc267e5006c60fe789019bbfb85933715f175dad804aa1bde4af48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\008ba4b5-5087-4885-8488-48d6fdcf7512

Filesize
671B

MD5
5acebd7b636de739e9c6a5f9b160d2e9

SHA1
0ff2e8d51f530709e6c03ae4ffcbdc5d70115ca8

SHA256
d576866a7711a3c6d2c7fc3252986439f411d9d6b2d047df5aab0e72eb20608d

SHA512
1130b1bce114e24ccb3a3f44d2b511c6d0c07ed54480cd2589a8b4f8c7f5cb64a0cdcdbd6f3006c3f8fbfbd25e82bdd557fdcb747660d219e63d6e9269464958

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\36c11b98-1578-4a22-9225-61f1c49cde23

Filesize
982B

MD5
2fd4e3062e63d3cb920f16512310cd91

SHA1
0d8ea15836084b715ea952f3174af36f8683335b

SHA256
c8294727c708ed4dc4eb45c64b9023cb685df05ce5e591dbb031e1bcd17b2674

SHA512
23e750e335bf92d3068797f3b5a9b6edf6efc6b48da3c275871d9930dfdcee4cd5ef3d4d932cf2671730f0d33335ed34e459d0d2427b7ee6562584eb1fdb28c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\63829da7-6abd-4590-972b-00c5e299e8ed

Filesize
1KB

MD5
44533ed36d2ab5d156fe409546c910e9

SHA1
f2d5b2936b5cecbf68425eda7ff1f6d582e70912

SHA256
fd3a111be529b1d0e30eb4c869439052d065b0a79265231ca35d6c8f6e469463

SHA512
0ae4db15af16c26c6fdea9bc71366cadc73a8685f3513393e5d4873fbc0f9883250a50a2a747e2062ea78a44ee06a11bcde1eef7742dad00c418c605f676c50c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\999e3592-8d05-4442-a5a3-9579090415eb

Filesize
26KB

MD5
005d7cbafb62329791bc7e88bddb6896

SHA1
b1f482749e89b811f98fa1ee831cf19761e3e10b

SHA256
570500c8332e05b21785455e052232db80553d1b2860ebf147f14af36b12f2e9

SHA512
e37cbffb19ceeb0e71e3091f52007b88b8a00460994e3e8e7c958853b289ac08434deebb7494745d5b000f40615dc9a6a846f828e52fd19f27771e7404fa47e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\f780ba72-4cd3-4537-98fe-0245cefba382

Filesize
846B

MD5
4bb311259fa0328021de9c61288862bc

SHA1
833d5282da261e7f60d3fb6cc3868821196423cc

SHA256
a3010c01ddf21740d5604e447a743c4814dc998e0ee1dd1efe28bcbbef7a6805

SHA512
1eac1940243041332e031f2aa65ed9be674386c428f7a85685ce89f6dd7dd93bba801aa05e075d5fa6b79c15e701264ab37d42462bd4ded0d1b0f8bd20d1dc18

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs-1.js

Filesize
11KB

MD5
e1a05ef170c5109b027094359fda3f51

SHA1
f786aa061cdd87048a5e875e3135dcc3bafef4b1

SHA256
cbd784a10a6b520dc9b5bce555b53d5c794eb7dada489c928398c7ad029ca4a8

SHA512
8bf76ff775a5f4b2889ccddaa08e917b36c60180dd05c7e4aca783a8cf61b96edc9654bba170a66a49f232dab3ac4c11be492478deb308642631ba2509bfb89a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs.js

Filesize
10KB

MD5
4d7a1c60992dcdfca8adf02ac90a475b

SHA1
64d1cb3f17961bba97d57d9ba4f5da789a0fb9b0

SHA256
5b0277d9f9c7881213a2814431ea0495b9e6ca7cf609a8460a1ef7af81cfa9a2

SHA512
252b0f8f7953a197c3b295ab326bf3560d1cac2ee20322249ba9cf918c4c655a6bc177733d0261a79ef8801440341f6baa45f5c5f2b769132a43ca7b82797dc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs.js

Filesize
12KB

MD5
80204d8690d2375cd046f38352fc88e7

SHA1
f1ce5c73314124ae8073e885b650706bf4fd7892

SHA256
42830a45d63fe6076b8e6c9b13b7eaec9c91c98fa2187e8391dfd35f680ea6cd

SHA512
5c73d341ffc06ff55ea67fc4ce4e5f7fa9ff67b059b57840343249d31f159d92ebd9cb982db8f67968c6e11cbf8682a711ca8d5ed18f4c8e3ddb919bee9ce63b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
6b22f60c7803cc1b4f577cfbdba9d424

SHA1
5f34edbfd626fec3e593277d7483a9fb69001533

SHA256
672890af6a586c4615e31c76240da0491718f34891b01bef33c6bea46929bc80

SHA512
5c578ec27ae5fc3aafe94b81af6f2301a0ebdad3c0e5e30aeffb232a1aaa6c14c3f756344d0b48768b932e3c3fb4645cb7bd10b4e0a6e68015076a7fa2874f38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
1b557881533fb89008249ac145bf17d6

SHA1
d883c33d47d6e0ae86bc942a07894bb7d4b2d7d7

SHA256
28467ba5f180ec1101b684eee7581b3aa1ed642c5ce5e7679652fb647c65a548

SHA512
f75708bb013ec62c76285854ef2ae63af67180541e6b114a6ff774ede13059092271454602f11daeb151ff82fcfcfcfa4738b7cf3fa5b5580fb3e6e9b999af16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
eb9fd76181fddd3b4c63a1eddcc5b489

SHA1
8da9fae9774b811a135111db55bcf91ed072d969

SHA256
f2c1b65e436d719f1b4f961139bbf2d2757b44c792640666a34641a72fead138

SHA512
559aef3556939fac808aa57e16d8193982f729ff806d4a2e4107a4fee5fac053aff1caf837648d7f1bda22fd48f27d3868f1a483f4b35bb16fa2b1680dd132b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
380ba1f87699fc69109b07bd14f28085

SHA1
82eba61364c8e2a157e864a354bdf9f60f24d518

SHA256
69baf739f38b8f2d04c08bdad0410383ca29e76c1ea68d65e773d79e64abd5ca

SHA512
4d7052860044b3292b7476aa4360966681ce7077980f6200cceba77371c9a1db78329379962fc987d75d28f38b2477210ba4e4df6fd511296ac7a4004111f916

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
07c637b549f1284b538569a1e1662131

SHA1
2b68a21d28d012aabfd33a67d9d1433a70c75660

SHA256
d68a2153e808d737a135391b7d8c09b94c3c73ab424e8a4f888107f89b4bc6b6

SHA512
8146194d043cb2705e50e4eb02709386a66cfba41937b1bf897dc04a8c8827c4339177466626f4f97e38fc8d80c81307093026bad3ef063e61a01514721f09d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
584KB

MD5
e4f5520e8a205ed0d715d31891385b7f

SHA1
f6833810666750dbf81346c01fcfed71f5d1148a

SHA256
ccdd561a57da353b086560dff28c51eb78d79eb4dad0e1b4c5c7f76c5f7113cb

SHA512
dd636692b503c6b2f92ec2fa51834602afa6f3d361a62a0a2008882b022e8b261171b169d0655e52b23640c8463303fd49e4f5f23cf858540e0241054e3f28f9

Download Submit
C:\Windows\Installer\MSI1855.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSI18C5.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI1F2F.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/1564-2807-0x00007FFCBFEA0000-0x00007FFCC0962000-memory.dmp

Filesize
10.8MB

Download
memory/1564-1-0x0000019BEC340000-0x0000019BEC40E000-memory.dmp

Filesize
824KB

Download
memory/1564-2-0x00007FFCBFEA0000-0x00007FFCC0962000-memory.dmp

Filesize
10.8MB

Download
memory/1564-4-0x0000019BEE960000-0x0000019BEE982000-memory.dmp

Filesize
136KB

Download
memory/1564-5-0x00007FFCBFEA0000-0x00007FFCC0962000-memory.dmp

Filesize
10.8MB

Download
memory/1564-2382-0x0000019BEE9A0000-0x0000019BEE9AA000-memory.dmp

Filesize
40KB

Download
memory/1564-2384-0x0000019BEEA20000-0x0000019BEEA32000-memory.dmp

Filesize
72KB

Download
memory/1564-0-0x00007FFCBFEA3000-0x00007FFCBFEA5000-memory.dmp

Filesize
8KB

Download
memory/2856-2803-0x000001706A7D0000-0x000001706A7F4000-memory.dmp

Filesize
144KB

Download
memory/2856-2805-0x000001706D290000-0x000001706D7CC000-memory.dmp

Filesize
5.2MB

Download
memory/2856-2808-0x000001706CE50000-0x000001706CF0A000-memory.dmp

Filesize
744KB

Download
memory/2856-2810-0x000001706CF10000-0x000001706CFC2000-memory.dmp

Filesize
712KB

Download