Analysis
-
max time kernel
99s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-12-2024 21:45
Static task
static1
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe -
A potential corporate email address has been identified in the URL: [email protected]
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
Executes dropped EXE 4 IoCs
pid Process 1884 Solara.exe 2788 node.exe 1864 Solara.exe 3580 node.exe -
Loads dropped DLL 13 IoCs
pid Process 2024 MsiExec.exe 2024 MsiExec.exe 4068 MsiExec.exe 4068 MsiExec.exe 4068 MsiExec.exe 4068 MsiExec.exe 4068 MsiExec.exe 888 MsiExec.exe 888 MsiExec.exe 888 MsiExec.exe 2024 MsiExec.exe 1864 Solara.exe 1864 Solara.exe -
resource yara_rule behavioral1/files/0x000d00000002b85f-2819.dat themida behavioral1/memory/1864-2822-0x0000000180000000-0x000000018110B000-memory.dmp themida behavioral1/memory/1864-2821-0x0000000180000000-0x000000018110B000-memory.dmp themida behavioral1/memory/1864-2823-0x0000000180000000-0x000000018110B000-memory.dmp themida behavioral1/memory/1864-2824-0x0000000180000000-0x000000018110B000-memory.dmp themida behavioral1/memory/1864-2959-0x0000000180000000-0x000000018110B000-memory.dmp themida behavioral1/memory/1864-3091-0x0000000180000000-0x000000018110B000-memory.dmp themida -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 -
Blocklisted process makes network request 3 IoCs
flow pid Process 15 3476 msiexec.exe 16 3476 msiexec.exe 17 3476 msiexec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 5 pastebin.com 20 pastebin.com 25 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1864 Solara.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\bom-handling.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\timers.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-rebuild.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-normalize-package-bin\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\node_modules\minimatch\minimatch.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\dist\src\promisify.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-help-search.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\bin\npx-cli.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\end-of-stream.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\stream.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\merkle\verify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\diff.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\aproba\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\internal\streams\end-of-stream.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\examples\normal-usage.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\deepest-nesting-target.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmfund\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\opts.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\aproba\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\readable-browser.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\sign.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-find-dupes.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\promise.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\lib\constants.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\envelope.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wcwidth\docs\index.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\example\basic.png msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\publish.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-explain.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man7\scripts.7 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-pack.md msiexec.exe File created C:\Program Files\nodejs\npm msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\index.es6.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minimatch\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\read.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\gypd.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\util\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\process\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\validators.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\builtins\License msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\build.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\parse-proxy-response.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\sync.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\id.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install-ci-test.1 msiexec.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File created C:\Windows\SystemTemp\~DFCED42F1A01E8BE9A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB151.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2AA.tmp msiexec.exe File created C:\Windows\Installer\e57a316.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAC6C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID829.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID9EF.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIB7AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID77C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\Installer\e57a31a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIACBC.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF716CF2CC3309CFE1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB77F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE0CA644C7311032E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0869CCF805BC939F.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57a316.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIACCC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDB38.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3524 msedgewebview2.exe 2284 msedgewebview2.exe 256 msedgewebview2.exe 2716 msedgewebview2.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3168 ipconfig.exe 764 ipconfig.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2708 Bootstrapper.exe 2708 Bootstrapper.exe 3476 msiexec.exe 3476 msiexec.exe 1884 Solara.exe 1656 Bootstrapper.exe 1656 Bootstrapper.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 4676 msedgewebview2.exe 4676 msedgewebview2.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 2716 msedgewebview2.exe 2716 msedgewebview2.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe 1864 Solara.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 492 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1896 WMIC.exe Token: SeSecurityPrivilege 1896 WMIC.exe Token: SeTakeOwnershipPrivilege 1896 WMIC.exe Token: SeLoadDriverPrivilege 1896 WMIC.exe Token: SeSystemProfilePrivilege 1896 WMIC.exe Token: SeSystemtimePrivilege 1896 WMIC.exe Token: SeProfSingleProcessPrivilege 1896 WMIC.exe Token: SeIncBasePriorityPrivilege 1896 WMIC.exe Token: SeCreatePagefilePrivilege 1896 WMIC.exe Token: SeBackupPrivilege 1896 WMIC.exe Token: SeRestorePrivilege 1896 WMIC.exe Token: SeShutdownPrivilege 1896 WMIC.exe Token: SeDebugPrivilege 1896 WMIC.exe Token: SeSystemEnvironmentPrivilege 1896 WMIC.exe Token: SeRemoteShutdownPrivilege 1896 WMIC.exe Token: SeUndockPrivilege 1896 WMIC.exe Token: SeManageVolumePrivilege 1896 WMIC.exe Token: 33 1896 WMIC.exe Token: 34 1896 WMIC.exe Token: 35 1896 WMIC.exe Token: 36 1896 WMIC.exe Token: SeIncreaseQuotaPrivilege 1896 WMIC.exe Token: SeSecurityPrivilege 1896 WMIC.exe Token: SeTakeOwnershipPrivilege 1896 WMIC.exe Token: SeLoadDriverPrivilege 1896 WMIC.exe Token: SeSystemProfilePrivilege 1896 WMIC.exe Token: SeSystemtimePrivilege 1896 WMIC.exe Token: SeProfSingleProcessPrivilege 1896 WMIC.exe Token: SeIncBasePriorityPrivilege 1896 WMIC.exe Token: SeCreatePagefilePrivilege 1896 WMIC.exe Token: SeBackupPrivilege 1896 WMIC.exe Token: SeRestorePrivilege 1896 WMIC.exe Token: SeShutdownPrivilege 1896 WMIC.exe Token: SeDebugPrivilege 1896 WMIC.exe Token: SeSystemEnvironmentPrivilege 1896 WMIC.exe Token: SeRemoteShutdownPrivilege 1896 WMIC.exe Token: SeUndockPrivilege 1896 WMIC.exe Token: SeManageVolumePrivilege 1896 WMIC.exe Token: 33 1896 WMIC.exe Token: 34 1896 WMIC.exe Token: 35 1896 WMIC.exe Token: 36 1896 WMIC.exe Token: SeDebugPrivilege 2708 Bootstrapper.exe Token: SeShutdownPrivilege 4304 msiexec.exe Token: SeIncreaseQuotaPrivilege 4304 msiexec.exe Token: SeSecurityPrivilege 3476 msiexec.exe Token: SeCreateTokenPrivilege 4304 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4304 msiexec.exe Token: SeLockMemoryPrivilege 4304 msiexec.exe Token: SeIncreaseQuotaPrivilege 4304 msiexec.exe Token: SeMachineAccountPrivilege 4304 msiexec.exe Token: SeTcbPrivilege 4304 msiexec.exe Token: SeSecurityPrivilege 4304 msiexec.exe Token: SeTakeOwnershipPrivilege 4304 msiexec.exe Token: SeLoadDriverPrivilege 4304 msiexec.exe Token: SeSystemProfilePrivilege 4304 msiexec.exe Token: SeSystemtimePrivilege 4304 msiexec.exe Token: SeProfSingleProcessPrivilege 4304 msiexec.exe Token: SeIncBasePriorityPrivilege 4304 msiexec.exe Token: SeCreatePagefilePrivilege 4304 msiexec.exe Token: SeCreatePermanentPrivilege 4304 msiexec.exe Token: SeBackupPrivilege 4304 msiexec.exe Token: SeRestorePrivilege 4304 msiexec.exe Token: SeShutdownPrivilege 4304 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 492 msedgewebview2.exe 492 msedgewebview2.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2788 node.exe 3580 node.exe 3196 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1552 2708 Bootstrapper.exe 78 PID 2708 wrote to memory of 1552 2708 Bootstrapper.exe 78 PID 1552 wrote to memory of 3168 1552 cmd.exe 80 PID 1552 wrote to memory of 3168 1552 cmd.exe 80 PID 2708 wrote to memory of 3852 2708 Bootstrapper.exe 81 PID 2708 wrote to memory of 3852 2708 Bootstrapper.exe 81 PID 3852 wrote to memory of 1896 3852 cmd.exe 83 PID 3852 wrote to memory of 1896 3852 cmd.exe 83 PID 2708 wrote to memory of 4304 2708 Bootstrapper.exe 85 PID 2708 wrote to memory of 4304 2708 Bootstrapper.exe 85 PID 3476 wrote to memory of 2024 3476 msiexec.exe 89 PID 3476 wrote to memory of 2024 3476 msiexec.exe 89 PID 3476 wrote to memory of 4068 3476 msiexec.exe 90 PID 3476 wrote to memory of 4068 3476 msiexec.exe 90 PID 3476 wrote to memory of 4068 3476 msiexec.exe 90 PID 3476 wrote to memory of 888 3476 msiexec.exe 91 PID 3476 wrote to memory of 888 3476 msiexec.exe 91 PID 3476 wrote to memory of 888 3476 msiexec.exe 91 PID 888 wrote to memory of 3752 888 MsiExec.exe 92 PID 888 wrote to memory of 3752 888 MsiExec.exe 92 PID 888 wrote to memory of 3752 888 MsiExec.exe 92 PID 3752 wrote to memory of 3488 3752 wevtutil.exe 94 PID 3752 wrote to memory of 3488 3752 wevtutil.exe 94 PID 2708 wrote to memory of 1884 2708 Bootstrapper.exe 96 PID 2708 wrote to memory of 1884 2708 Bootstrapper.exe 96 PID 1656 wrote to memory of 1276 1656 Bootstrapper.exe 103 PID 1656 wrote to memory of 1276 1656 Bootstrapper.exe 103 PID 1276 wrote to memory of 764 1276 cmd.exe 105 PID 1276 wrote to memory of 764 1276 cmd.exe 105 PID 1656 wrote to memory of 2788 1656 Bootstrapper.exe 106 PID 1656 wrote to memory of 2788 1656 Bootstrapper.exe 106 PID 1656 wrote to memory of 1864 1656 Bootstrapper.exe 108 PID 1656 wrote to memory of 1864 1656 Bootstrapper.exe 108 PID 1864 wrote to memory of 3580 1864 Solara.exe 109 PID 1864 wrote to memory of 3580 1864 Solara.exe 109 PID 1864 wrote to memory of 492 1864 Solara.exe 111 PID 1864 wrote to memory of 492 1864 Solara.exe 111 PID 492 wrote to memory of 1228 492 msedgewebview2.exe 112 PID 492 wrote to memory of 1228 492 msedgewebview2.exe 112 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113 PID 492 wrote to memory of 3524 492 msedgewebview2.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3168
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A4C89451DBECD45D12BB18D594E3C6112⤵
- Loads dropped DLL
PID:2024
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0796779229432B161B08E36AF81257B92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4068
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F061FB06E5A7940B73C303362A40C541 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵PID:3488
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:764
-
-
-
C:\Program Files\nodejs\node.exe"node" -v2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files\nodejs\node.exe"node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 702941db7c2243963⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3580
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=1864.4100.99848698215562047433⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x100,0x130,0x7ff9cb643cb8,0x7ff9cb643cc8,0x7ff9cb643cd84⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1904,6255732254556537876,9361070938583082063,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:24⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3524
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,6255732254556537876,9361070938583082063,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2088 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,6255732254556537876,9361070938583082063,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2512 /prefetch:84⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2284
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1904,6255732254556537876,9361070938583082063,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:14⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:256
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,6255732254556537876,9361070938583082063,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4600 /prefetch:84⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2716
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4184
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3196
Network
MITRE ATT&CK Enterprise v15
Discovery
Network Share Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5a901e85a8ec9ce8e52bc8eabae6faef3
SHA1a099eff688c1c71421bd86f3e79ae6d08c7b1c89
SHA256a0a2d752a7682fe8b00850213eded1d0c3a54ff6c5329d16f1feb000b955b533
SHA5125609d6819c0b603440993b492a4a63766efd303d8c8bbc6d3d5ba50fa74885d5c87fc84de08d79f03480b7c3b38e24df1a7f1e415a10c308e82e5a001f2fe697
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
Filesize
133B
MD535b86e177ab52108bd9fed7425a9e34a
SHA176a1f47a10e3ab829f676838147875d75022c70c
SHA256afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
SHA5123c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
-
Filesize
6KB
MD50e709bfb5675ff0531c925b909b58008
SHA125a8634dd21c082d74a7dead157568b6a8fc9825
SHA256ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67
SHA51235968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd
-
Filesize
2KB
MD5b9e991c0e57c4d5adde68a2f4f063bc7
SHA10cb6b9eb7b310c37e5950bbcaf672943657c94b5
SHA2569c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241
SHA5123bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6
-
Filesize
1KB
MD5826bd4315438573ba1a6d88ae2a2aa65
SHA13e27986a947e7d10488739c9afb75f96b646c4c5
SHA2560fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956
SHA5122e98ba8e57cb0950e45d20365d16e86ad94a60cfd4cf103b7d55dae02de677985d37c0f771e16ae0a628cb3b59adce8a9e1742cffc298f18cb7d935d72536e6d
-
Filesize
1KB
MD571a7656944ffe50cc27ebe02491ae49b
SHA18ebf0f80660d982fc68f00f82855696157e74b10
SHA2566c3d2c892db282317913ce7c340dd2edccd326bcafd18b644b8738144967d6ee
SHA5125b0010b41304e212a22d2c89eff65ce410b000c71c4ab8c7fdba8f549ba0629fe27f37c142058b041fb889bc73e00959ad58f673866ee7d29724687da3c3f320
-
Filesize
4KB
MD574bdccf347345d27fe8a4ac3add99c60
SHA1a2b8a915c86fc750f56a7137860f19ec1182ee21
SHA256d8d1c1d6c387ab67c3f28d78fd0b20b9becd69442db9d3efe110ca464b509c8a
SHA512c2d47efee2a4442be6375d623f46b4c7ee9552c132b9229eb284bdd98629edd02664167805b0af9b3faaa9b1906e9ed0c5e383396d4995cef7051f9a450e1b99
-
Filesize
263B
MD5dd13897ea2eed92695bb7e4e744a9148
SHA1182314d32e789e4f9c29e3150ae392f1630f171c
SHA2569a34fedeb2d269c46ed94e6f13039eb0d16d866dd460ec66fa3acd78122fa9fe
SHA5120b53bc984178336ac516601e72d477d2beeef6936800da17d3a79c153e0036f7428517ebd75d296729f65856c7e07749029f5aa192b2ac071efc4d3e39750a32
-
Filesize
5KB
MD525807a97fbb1fcc42a013abc7d7768c4
SHA1f24d52cbc9144b011def218234ff7b50e7ddcb19
SHA256a3e83594a4ce88997e2e4fc66bc942b17b9d736290ad62560c7f09d6d0989ad0
SHA5128d316b63700126d7c8965a886e9b35a332d3f7e68d28f2264d235c0afad28066f877f25821e1983ddde5f2d5052716cc73338779b41b6f4d1b90ad33dc3e9f24
-
Filesize
10KB
MD5002a1f3e813cc05d9e3cc011f6601628
SHA11690c27457637ec234d6b7658f1b96e547a0eb99
SHA2564d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91
SHA512ea1ad9bcf09a73a10dd1fd8a66daac12f87725e16ad27e7beff6d9fda937579976cd5d7ed6439c4122b16178c3ffdf410d6c7a54918f94bc98fa7950adf3bd54
-
Filesize
1KB
MD57f0a9d228c79f0ee4b89fc6117f1c687
SHA13c10082c1464a6f589aa10cda88285e780ebf857
SHA2565a3659bcc2e47b25ebf9f23f38eb9452a58920bfe4b59410bfa6fe84639a3b99
SHA5127bdd7259bcb8d79aa41777f03d3a3f8a29b60c2d25104072edba9febeb813e12ef78d31573637702decddbaa97d8fec263bc413bd27dd660ded17d644458cbc2
-
Filesize
1KB
MD5b90cf71779f72e14be703a4e494e968c
SHA1842f42d9ee581d91ac82a7fa018f61bb3f8ef63a
SHA2561d0a4e941c1504dcd9bc6cfbb77f7b44d93e56a29cba6f2ccebd78d501a51c16
SHA5128db5d9a938f397c11c75c77c0cbe6eb609c5d4f81a590f221163fe3291cd0cb2a6286ba8935c8f8cfdabecec9f7e49a5bfa836dc777e936271fbe0daea7414e6
-
Filesize
1KB
MD5453a9bb10c91e0ec44f305b14e30ce82
SHA173c01b81f34a9978b158df2744ef8c45251d6193
SHA25630b1a43843675f42033fd6c77c19b20ad4344844f0bd5526c586081e93a48fe8
SHA512d81ee5f2394493a5f93918ecae6581f82ee529fbbd257e0dc10ea68f09c39d0d19e3a6b0e9560eb1250d88a9b1f591d6469f28404410b16b580cbe179e37da0f
-
Filesize
1KB
MD50c95e46d0f08bd96b93cfbea66888afc
SHA1dfbb19c79eb0ca7ff2625fb1975a35cf47be378a
SHA25642a7f91883d0c5ce9292dda4e017e1f8664d34b09276d89fb6f3859c29d1ca9b
SHA512fbeb545274e55f0dface8407a563878083e8d2edc16320a31802e7b4c1dbf6d37f20b772c7436cb1810adb524ef86b3378b6b76a35e0967b6cae58340c58d4ad
-
Filesize
434B
MD5e9c758769fec9883d5ce3d30b8ee1047
SHA1f9d3fd64a0196e77965489ce9b81fe4ce3a9ecb1
SHA256bd320a3e9d23249f5f7d3ce72f2fa426e28a6b2704bd2b281d0c92806a1f5223
SHA512e54bbb849368a53c620b65d0e4a847869dea8fbb767f3559315d9e031c11f23df4ac9d746b7883caf3f693c748e1b9c90f8789519891ed179399341cd49dcae2
-
Filesize
224B
MD5866e37a4d9fb8799d5415d32ac413465
SHA13f41478fdab31acabab8fa1d26126483a141ffb6
SHA2564d2f5afc192178c5b0dc418d2da5826d52a8b6998771b011aede7fdba9118140
SHA512766d2e202dd5e520ac227e28e3c359cca183605c52b4e4c95c69825c929356cea772723a9af491a3662d3c26f7209e89cc3a7af76f75165c104492dc6728accc
-
Filesize
14KB
MD515cf9c2f48c7ba6583c59d28908e3e27
SHA119c7718f6a3d0f9dcd4ca692c19718ec29aae092
SHA2565901b32f609ba349351bf7406dbdc0c4c57b77ce6f7215ea67ccca5ac2a28e88
SHA512c063277a59b83dffc085116769475ec5cce1c47c167b9bd2246e8bda04f0ebc2773b5f06e3b44fc5ed057e043f6d33e77741f34d15e22542134e3865574a29be
-
Filesize
2KB
MD5d467bc485eddf6d38278bc6b1dc16389
SHA1e233882de62eb095b3cae0b2956e8776e6af3d6a
SHA2562f25585c03c3050779c8f5f00597f8653f4fb8a97448ef8ef8cb21e65ba4d15d
SHA5122add66b4f2e8ce463449ca8f2eac19363844b6ab159a41b42163028c57f07a4245ebefe759a6f90e8685b5bd239c969fe99366eff89378cb8b92b8a703dacd61
-
Filesize
2KB
MD53b5b76b70b0a549dce72c5a02756d2a8
SHA107786baebb5c52882e28a8bd281c9a36d63dd116
SHA256bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859
SHA512bb266dfa725421fb26d26fda0f45a5fa5cd832667b05f27ceaf4e7fc1e032aeea8700493cfdd2941c3c38cd166eee1000d2b9ae3ddef375714e25a2027a943a3
-
Filesize
6KB
MD5d50e9637775204f194d629000189f69c
SHA150d1a1725cb273b0a8e30433dabc43d65f55169b
SHA25696900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540
SHA512563a8375e3ab7936162a9d209800f8b41c416c1500fe24de817871c3e5489e8faf5a4dcb7fb239f697a8736432356e60ecf1578d0aafc0de80d6e0ae90c34aad
-
Filesize
1KB
MD53d09ac571e0b6eaf8fdb9806118b6d30
SHA1eb758bb6a7d3e4f32f0fa2f941265678539e74f1
SHA256243d853d4386c4132508ae9a99e5176b25be7f5cb6967bc1bab241f20e937e72
SHA5120207cf364e3eac974cae61ec68fe3975fd1f1eb6150f51293ce67f62dbb0f27a3d9c193101ef282dcd099fc653ca73cd3c875c18e5e266964038e3334697b5b4
-
Filesize
1KB
MD5b4d3859e603602c87a45682862055af0
SHA1e95cb1c14d70be457eba2ce61b2f4e90a13b21b1
SHA25688564234b9eeb2f0fe2cc5d03f617a97eb4802f126bdd21aa223c3c87c02531c
SHA512b17bb8c8b652f27d8037ed60f28b0d19a68e77bcc45d1e2be7dd304c942f6e85570e9720011f983fb8783d670eb66c0c3174d5fd90690b2aa79c2b402adcd00a
-
Filesize
931B
MD5570e06d8ce0167e07a32ba70fdd56795
SHA139dc652dfa419d46d6fed0835444c603c57077f8
SHA25645ebe570483c48b6460767fc4a0bb69e4dee4bf4becc645b0e0627172a30a580
SHA5129c8ddf41b3207016935affce00108d87f176a9e473a01f03f1110456397c88ee2fbaf34f9e497e6cbff2b65c4f4c7f254a5129b4c1eaa2b85fbebffb8fe43777
-
Filesize
2KB
MD5ae157c9a8e70902576c2d8a06dbcde32
SHA10d10ee921436fa5ff5988445cc67676219dfffbe
SHA2564bd92209cb9dacf3e3773e725acb7aaec43ea9e78540324e4d0f73e5ce9adef7
SHA5124c2f31f1f2a297ab6c55a21d58a5c26cad22c1ed1913e7a48605111d217257ae2d9f26ea889e8610e011ba9b9c487c91ecdb4cea3437534faf905e8fb89ba248
-
Filesize
704B
MD5cbd55880a650b56c3d5acddbbdbee9bc
SHA14d354da7ece1c7d5689b8104f3b6f3dcbac7790e
SHA25630fbfaa3840b2f63978ad4bcd7ed8dc24d277b818e4755fe93eda8cb1bc8b74c
SHA512e329a6f6a38dd33bd60334a8dec4a91aa6e7dab28f0893240374ae6a303c12646399d821403e3b80eb51317d1808e6abf30bd91b0bd99951f96815a22ba105c7
-
Filesize
4KB
MD5b1c3d24b92f25989b8aefc7f6aaa91ba
SHA13f69307bd04cc4dfe71cd13616509f443b48f923
SHA2568e16bae14ec63bac9cdbb50572a7b53061fee914712f5e803ff03c44e8845276
SHA5124225c714bec718d7cc59cd2c91a07a77e41cce3ab52502bf9b5b9ccd7d0ce88c040e0a765e5b2c3576ac8f101dc00fff94f8c7ac7586111a545b228831a11ed0
-
Filesize
1KB
MD5436846dd0f4348ac2ee93c9c5eb291e4
SHA1777e9cd400b42dee1199eacfb325876caeaff3cc
SHA256c812eca4b0dee2317cb446124cb27ae8e5b993c8fdd0144886b629ef6ef53fc1
SHA512d261e261bc9d2e5a39a50c6b072e6da995764769abdc4f9f3cf219cc2296c0e45ee194c3f4f431a248fd1d46d90745ad0b576d2fcb24e59d9208804b9c1532d7
-
Filesize
53B
MD5b9f2ca8a50d6d71642dd920c76a851e5
SHA18ca43e514f808364d0eb51e7a595e309a77fdfce
SHA256f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde
SHA51281b6352bbabd0bffbc50bfcd0cd67dc3c2a7d63bda0bf12421410c0ec8047af549a4928b5c5c3e89ead99aa9240bddb461c618c49287c15d9d4d3a899e8f596a
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD5c6f770cbb24248537558c1f06f7ff855
SHA1fdc2aaae292c32a58ea4d9974a31ece26628fdd7
SHA256d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
SHA512cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a
-
Filesize
152B
MD532208cd41f0200d15b3fdeb178ff37ea
SHA187606ab71d79200b02ac31e48d23ce6f913ba324
SHA2567e20124ef2fd2fe0815ff6de70e41531c6613cb095815ab4aada7b8e66eaeba3
SHA512f9b1a0f15fec1f8fa31e6ebdb1da933d7df7ca5632435c83c67df7aefb533371e84bc4918e412bffccc99142e62efea797ae5ccd756a4e4f35b7b3cf93a95516
-
Filesize
152B
MD5e3a5b92f782fb1fb777b7ede4942cc7c
SHA15562a1c60c539deed3bb9774a3d13472266351bb
SHA2567e4e7ac95305a57fb1324777cef66084cdd546b057faf625b1a396595f02fdee
SHA512c49cde0c0865856292069c356347a514f2a041b49ab037be015291993cd3a7510bbe0ef41bbe7bea54e67c1d9348702e0f49d05d4b5436967ac6a8bf5f3a4158
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
824B
MD5dcdb6b8a20a694e8ba3a5d42ea5c8c4b
SHA1f05f402937a00fbfe59f5a0fcc9bb11384b5628a
SHA25608ba5a3f94be6c8edcebffebfcff69f7cf25f65a14c9d868b1dfb915c73d734c
SHA51274d6fb79ccbfeabc9ccb9caf64514564ccc75044402fdd5e34e224571bdee962521dd767ff4bcd298bea22d09cbffda44146a988f352c1e36f6abdb5bc467690
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
4KB
MD570c64dbeee017e16d318ebe63c6c0470
SHA1952f55cf742f13bd35a806e833517f65b6474b1e
SHA256908e3e43f8e32743aa0c24ca9eaaf51a6fdabae2a6d93d91a4ef579af0a1dfc4
SHA5121a2a688a48384fa9b295783ec1fa7f7c0df159b32fdb2aba83f9940d6830fb9175e91c23f564ef632ae93eb6861d160c8dfd479baad24b792093df6a2abfed20
-
Filesize
3KB
MD503afc15ccd8b01c6e79fd354990cdc9c
SHA130bcee9c09dfe111ea786d9baee4d615348ca044
SHA2567b0a3e062a88b66eefaad67388e6526062985beab15e24efa64d4f5f2c45a97d
SHA5126d692b8254ae69933165ddd0332f238057b3ed5568249e0da7f3350187cd1a0a21e7ee064804ad3391081fca0e6cabb24a2ec4884f811ecb82e14ad7dff9302c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD5ee75ea60e524296950720a58ee196d86
SHA1f425745454a7ccd7b7c94adee733413b940c8fb6
SHA2569785577f7b08672895f2a76ae9eadc962c8443ac6128bc36f6c3348a931cfc74
SHA512bdad27de069776cd31018d72df10ded4e8cd3d60ac674614b00f7e3706f8cda30511f84e3e7afb86c83c0b47953aeac9708e205b75e83226d590474236227ead
-
Filesize
8KB
MD5a025b31e64d2f23a65957e2587cd7f28
SHA1ab3a95ff3ea86fb83177033cf7fa570e5af3dc02
SHA2564a376ee13743e47034da06fcd59addc50b4b3f582df0272e98b80e92d8e409f9
SHA512ac780e0073f9ff5edd681b7188f1a1b8d190dd2154a91c44e4090f0f527a27405640eaf11843de0d0eb5df4bab0423de30d47fd11f88ece7ebd07e86ae0b9c89
-
Filesize
6.6MB
MD53daecb906d45a7625d3cc10e5a4855d9
SHA14937a978edc76203bc779146f371b89c4a5a6e7b
SHA256b91b1be84411aa19d13a56a0621f451bf7593105bff48d5c177db900e5a20f3a
SHA512e913306d8634a2e0202cbbedfe2b7545dc4f5476c5b1ceb62056424534fe1582dc22220b07de4a54125701007a13a424d30e57934da92e6cf80b361253108e4d
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
5B
MD537aa1f84af14327f56844e2a6e046b8e
SHA14ab41557ec631ee3866c62a76f31339f95da5c40
SHA256800febbfd5e51c2df3529c3dbd5ac3216cb3485be40ec10c9f9168382c4bfcd9
SHA512ef7237d3f954790262bd73f129fda3db2fa7c3b4f9eb827d46d38a033c3198ed1e4921374a9d66a523de7d13bc5754e462b69dab93d7e62827453b0d813ba7de
-
Filesize
1KB
MD5b9aa6d2ae7fda3d4487a6b9d0b40c3da
SHA13d17d741be40d1b10e2c984c2fd4573c371ddc4d
SHA256dcbcdbab49c35e623c96dd82e13a2bfcb434dbfd511c1451f8c8bb5d4efb7d0a
SHA512c387d9bebe8a74f8129eacc8c53393e7c12bfd48966204c574f5c8d971b490a1f48c65643c71fed02fb8568033fe789b527c44d15be951cc274bfbf812e3d0f9
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5e31f3c7128cedbfd32b3895410bbf97e
SHA1e3aef4314a086db60f226125ac4f4e02186bdef4
SHA256893323b39105fc80d79f2a4ff339fa268346d20cdb8dcbfa8a9e6cd33c4c7261
SHA512a1869718aeee4e080c034f3fb939bfeb400c9ceb1177e5a190088807993091a673206cd382cc5e33cc0cb62f59578686d8b36ea98b4870eb102b0719e1415cab
-
Filesize
103B
MD5b016dafca051f817c6ba098c096cb450
SHA14cc74827c4b2ed534613c7764e6121ceb041b459
SHA256b03c8c2d2429e9dbc7920113dedf6fc09095ab39421ee0cc8819ad412e5d67b9
SHA512d69663e1e81ec33654b87f2dfaddd5383681c8ebf029a559b201d65eb12fa2989fa66c25fa98d58066eab7b897f0eef6b7a68fa1a9558482a17dfed7b6076aca
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec