Analysis
-
max time kernel
489s -
max time network
488s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-06-2024 05:19
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win10-20240404-en
General
-
Target
SolaraBootstrapper.exe
-
Size
797KB
-
MD5
36b62ba7d1b5e149a2c297f11e0417ee
-
SHA1
ce1b828476274375e632542c4842a6b002955603
-
SHA256
8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c
-
SHA512
fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94
-
SSDEEP
12288:n1mzgHpbzEu8AgpQojA1j855xU9pHIRxSNN:1mzgH385QojA1j855xSHI
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
Processes:
MicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cd57e4c171d6e8f5ea8b8f824a6a7316.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
msedgewebview2.exemsedgewebview2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 34 IoCs
Processes:
vc_redist.x64.exevc_redist.x64.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.81.exesetup.exesetup.exeMicrosoftEdgeUpdate.execd57e4c171d6e8f5ea8b8f824a6a7316.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exepid process 1128 vc_redist.x64.exe 348 vc_redist.x64.exe 1472 MicrosoftEdgeWebview2Setup.exe 4944 MicrosoftEdgeUpdate.exe 4168 MicrosoftEdgeUpdate.exe 1524 MicrosoftEdgeUpdate.exe 1784 MicrosoftEdgeUpdateComRegisterShell64.exe 4720 MicrosoftEdgeUpdateComRegisterShell64.exe 4228 MicrosoftEdgeUpdateComRegisterShell64.exe 1668 MicrosoftEdgeUpdate.exe 2988 MicrosoftEdgeUpdate.exe 1244 MicrosoftEdgeUpdate.exe 4652 MicrosoftEdgeUpdate.exe 1132 MicrosoftEdge_X64_126.0.2592.81.exe 2228 setup.exe 5016 setup.exe 3076 MicrosoftEdgeUpdate.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1992 msedgewebview2.exe 4944 msedgewebview2.exe 696 msedgewebview2.exe 3928 msedgewebview2.exe 4868 msedgewebview2.exe 2584 msedgewebview2.exe 3936 msedgewebview2.exe 3084 msedgewebview2.exe 4368 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 688 MicrosoftEdgeUpdate.exe 4212 msedgewebview2.exe 1824 msedgewebview2.exe 3604 msedgewebview2.exe 4256 msedgewebview2.exe 1812 msedgewebview2.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMsiExec.exeMsiExec.exevc_redist.x64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.execd57e4c171d6e8f5ea8b8f824a6a7316.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exepid process 4464 MsiExec.exe 4464 MsiExec.exe 3076 MsiExec.exe 3076 MsiExec.exe 3076 MsiExec.exe 3076 MsiExec.exe 3076 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 4464 MsiExec.exe 348 vc_redist.x64.exe 4944 MicrosoftEdgeUpdate.exe 1784 MicrosoftEdgeUpdateComRegisterShell64.exe 1524 MicrosoftEdgeUpdate.exe 4720 MicrosoftEdgeUpdateComRegisterShell64.exe 1524 MicrosoftEdgeUpdate.exe 4228 MicrosoftEdgeUpdateComRegisterShell64.exe 1524 MicrosoftEdgeUpdate.exe 1244 MicrosoftEdgeUpdate.exe 2988 MicrosoftEdgeUpdate.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1992 msedgewebview2.exe 4944 msedgewebview2.exe 1992 msedgewebview2.exe 1992 msedgewebview2.exe 696 msedgewebview2.exe 3928 msedgewebview2.exe 696 msedgewebview2.exe 3928 msedgewebview2.exe 4868 msedgewebview2.exe 4868 msedgewebview2.exe 696 msedgewebview2.exe 696 msedgewebview2.exe 696 msedgewebview2.exe 696 msedgewebview2.exe 2584 msedgewebview2.exe 2584 msedgewebview2.exe 2584 msedgewebview2.exe 1992 msedgewebview2.exe 1992 msedgewebview2.exe 1992 msedgewebview2.exe 3936 msedgewebview2.exe 3936 msedgewebview2.exe 3084 msedgewebview2.exe 3084 msedgewebview2.exe 2828 MicrosoftEdgeUpdate.exe 4368 MicrosoftEdgeUpdate.exe 4212 msedgewebview2.exe 4212 msedgewebview2.exe 1824 msedgewebview2.exe 1824 msedgewebview2.exe 1824 msedgewebview2.exe 3604 msedgewebview2.exe 3604 msedgewebview2.exe 4256 msedgewebview2.exe 4256 msedgewebview2.exe 1812 msedgewebview2.exe 1812 msedgewebview2.exe -
Processes:
resource yara_rule behavioral1/memory/1844-4214-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4216-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4217-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4215-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4417-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4438-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4440-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4489-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4535-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4785-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4806-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4846-0x0000000180000000-0x0000000180B0D000-memory.dmp themida behavioral1/memory/1844-4905-0x0000000180000000-0x0000000180B0D000-memory.dmp themida -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid process 7 2188 msiexec.exe 9 2188 msiexec.exe 11 2188 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 65 raw.githubusercontent.com 66 raw.githubusercontent.com 71 raw.githubusercontent.com 72 raw.githubusercontent.com 98 raw.githubusercontent.com 99 raw.githubusercontent.com 100 raw.githubusercontent.com -
Checks system information in the registry 2 TTPs 16 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 12 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exepid process 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exesetup.exeMicrosoftEdgeWebview2Setup.exedescription ioc process File created C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-doctor.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\nn.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\promise.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\index.es6.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\set-interval.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\node_modules\minimatch\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\chain.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-description.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\tag.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\base64-js\index.js msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\hi.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\safe-buffer\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\build\smartbuffer.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\promise-retry\package.json msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\WidevineCdm\manifest.json setup.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\npx.cmd msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\src\layout-manager.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\lib\reporters\json.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\concat-map\package.json msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\msedge_pwa_launcher.exe setup.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\config\definitions.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\lib\body.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ssri\LICENSE.md msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\Analytics setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\path-is-absolute\license msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\store\public-good-instance-root.json msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_pt-PT.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_gl.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\identity_proxy\win10\identity_helper.Sparse.Stable.msix setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\stream\promises.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\signature.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\dist\src\promisify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\with-owner.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\docs\Updating-npm-bundled-node-gyp.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\logging.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\Fingerprinting setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\pretty_gyp.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\builtins\License msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\internal\streams\state.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-adduser.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\promise-inflight\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\util\move-file.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_writable.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\notification_helper.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\sv.pak setup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\utils.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\concat-map\example\map.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\web-auth.js msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_fi.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\TransparentAdvertisers setup.exe -
Drops file in Windows directory 21 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI87A1.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSIACD4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9244.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIABF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIB340.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AFD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8D22.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9224.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8C94.tmp msiexec.exe File created C:\Windows\Installer\e57832e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI86C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8723.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAEC9.tmp msiexec.exe File created C:\Windows\Installer\e57832a.msi msiexec.exe File opened for modification C:\Windows\Installer\e57832a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedgewebview2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
msiexec.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exeMicrosoftEdgeUpdate.exeMsiExec.exemsedgewebview2.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641986400958847" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exemsiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine.dll" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CLSID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32 MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exeMicrosoftEdgeUpdate.execd57e4c171d6e8f5ea8b8f824a6a7316.exechrome.exepid process 4196 SolaraBootstrapper.exe 4196 SolaraBootstrapper.exe 2188 msiexec.exe 2188 msiexec.exe 4944 MicrosoftEdgeUpdate.exe 4944 MicrosoftEdgeUpdate.exe 4944 MicrosoftEdgeUpdate.exe 4944 MicrosoftEdgeUpdate.exe 4944 MicrosoftEdgeUpdate.exe 4944 MicrosoftEdgeUpdate.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4216 chrome.exe 4216 chrome.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedgewebview2.exechrome.exepid process 1992 msedgewebview2.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exemsiexec.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 4196 SolaraBootstrapper.exe Token: SeShutdownPrivilege 4724 msiexec.exe Token: SeIncreaseQuotaPrivilege 4724 msiexec.exe Token: SeSecurityPrivilege 2188 msiexec.exe Token: SeCreateTokenPrivilege 4724 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4724 msiexec.exe Token: SeLockMemoryPrivilege 4724 msiexec.exe Token: SeIncreaseQuotaPrivilege 4724 msiexec.exe Token: SeMachineAccountPrivilege 4724 msiexec.exe Token: SeTcbPrivilege 4724 msiexec.exe Token: SeSecurityPrivilege 4724 msiexec.exe Token: SeTakeOwnershipPrivilege 4724 msiexec.exe Token: SeLoadDriverPrivilege 4724 msiexec.exe Token: SeSystemProfilePrivilege 4724 msiexec.exe Token: SeSystemtimePrivilege 4724 msiexec.exe Token: SeProfSingleProcessPrivilege 4724 msiexec.exe Token: SeIncBasePriorityPrivilege 4724 msiexec.exe Token: SeCreatePagefilePrivilege 4724 msiexec.exe Token: SeCreatePermanentPrivilege 4724 msiexec.exe Token: SeBackupPrivilege 4724 msiexec.exe Token: SeRestorePrivilege 4724 msiexec.exe Token: SeShutdownPrivilege 4724 msiexec.exe Token: SeDebugPrivilege 4724 msiexec.exe Token: SeAuditPrivilege 4724 msiexec.exe Token: SeSystemEnvironmentPrivilege 4724 msiexec.exe Token: SeChangeNotifyPrivilege 4724 msiexec.exe Token: SeRemoteShutdownPrivilege 4724 msiexec.exe Token: SeUndockPrivilege 4724 msiexec.exe Token: SeSyncAgentPrivilege 4724 msiexec.exe Token: SeEnableDelegationPrivilege 4724 msiexec.exe Token: SeManageVolumePrivilege 4724 msiexec.exe Token: SeImpersonatePrivilege 4724 msiexec.exe Token: SeCreateGlobalPrivilege 4724 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeRestorePrivilege 2188 msiexec.exe Token: SeTakeOwnershipPrivilege 2188 msiexec.exe Token: SeSecurityPrivilege 1580 wevtutil.exe Token: SeBackupPrivilege 1580 wevtutil.exe Token: SeSecurityPrivilege 1444 wevtutil.exe Token: SeBackupPrivilege 1444 wevtutil.exe Token: SeRestorePrivilege 2188 msiexec.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
cd57e4c171d6e8f5ea8b8f824a6a7316.exechrome.exepid process 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SolaraBootstrapper.exemsiexec.exeMsiExec.exewevtutil.exevc_redist.x64.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.81.exesetup.execd57e4c171d6e8f5ea8b8f824a6a7316.exemsedgewebview2.exedescription pid process target process PID 4196 wrote to memory of 4724 4196 SolaraBootstrapper.exe msiexec.exe PID 4196 wrote to memory of 4724 4196 SolaraBootstrapper.exe msiexec.exe PID 4196 wrote to memory of 4724 4196 SolaraBootstrapper.exe msiexec.exe PID 2188 wrote to memory of 4464 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 4464 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 3076 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 3076 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 3076 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 428 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 428 2188 msiexec.exe MsiExec.exe PID 2188 wrote to memory of 428 2188 msiexec.exe MsiExec.exe PID 428 wrote to memory of 1580 428 MsiExec.exe wevtutil.exe PID 428 wrote to memory of 1580 428 MsiExec.exe wevtutil.exe PID 428 wrote to memory of 1580 428 MsiExec.exe wevtutil.exe PID 1580 wrote to memory of 1444 1580 wevtutil.exe wevtutil.exe PID 1580 wrote to memory of 1444 1580 wevtutil.exe wevtutil.exe PID 4196 wrote to memory of 1128 4196 SolaraBootstrapper.exe vc_redist.x64.exe PID 4196 wrote to memory of 1128 4196 SolaraBootstrapper.exe vc_redist.x64.exe PID 4196 wrote to memory of 1128 4196 SolaraBootstrapper.exe vc_redist.x64.exe PID 1128 wrote to memory of 348 1128 vc_redist.x64.exe vc_redist.x64.exe PID 1128 wrote to memory of 348 1128 vc_redist.x64.exe vc_redist.x64.exe PID 1128 wrote to memory of 348 1128 vc_redist.x64.exe vc_redist.x64.exe PID 4196 wrote to memory of 1472 4196 SolaraBootstrapper.exe MicrosoftEdgeWebview2Setup.exe PID 4196 wrote to memory of 1472 4196 SolaraBootstrapper.exe MicrosoftEdgeWebview2Setup.exe PID 4196 wrote to memory of 1472 4196 SolaraBootstrapper.exe MicrosoftEdgeWebview2Setup.exe PID 1472 wrote to memory of 4944 1472 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 1472 wrote to memory of 4944 1472 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 1472 wrote to memory of 4944 1472 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 4168 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 4168 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 4168 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 1524 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 1524 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 1524 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1524 wrote to memory of 1784 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 1524 wrote to memory of 1784 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 1524 wrote to memory of 4720 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 1524 wrote to memory of 4720 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 1524 wrote to memory of 4228 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 1524 wrote to memory of 4228 1524 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4944 wrote to memory of 1668 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 1668 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 1668 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 2988 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 2988 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4944 wrote to memory of 2988 4944 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 4652 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 4652 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 4652 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 1132 1244 MicrosoftEdgeUpdate.exe MicrosoftEdge_X64_126.0.2592.81.exe PID 1244 wrote to memory of 1132 1244 MicrosoftEdgeUpdate.exe MicrosoftEdge_X64_126.0.2592.81.exe PID 1132 wrote to memory of 2228 1132 MicrosoftEdge_X64_126.0.2592.81.exe setup.exe PID 1132 wrote to memory of 2228 1132 MicrosoftEdge_X64_126.0.2592.81.exe setup.exe PID 2228 wrote to memory of 5016 2228 setup.exe setup.exe PID 2228 wrote to memory of 5016 2228 setup.exe setup.exe PID 1244 wrote to memory of 3076 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 3076 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1244 wrote to memory of 3076 1244 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4196 wrote to memory of 1844 4196 SolaraBootstrapper.exe cd57e4c171d6e8f5ea8b8f824a6a7316.exe PID 4196 wrote to memory of 1844 4196 SolaraBootstrapper.exe cd57e4c171d6e8f5ea8b8f824a6a7316.exe PID 1844 wrote to memory of 1992 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe msedgewebview2.exe PID 1844 wrote to memory of 1992 1844 cd57e4c171d6e8f5ea8b8f824a6a7316.exe msedgewebview2.exe PID 1992 wrote to memory of 4944 1992 msedgewebview2.exe msedgewebview2.exe PID 1992 wrote to memory of 4944 1992 msedgewebview2.exe msedgewebview2.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
msedgewebview2.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{AE13C7E6-2308-4A51-9B94-101EE5A1ED72}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{AE13C7E6-2308-4A51-9B94-101EE5A1ED72}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=544 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUQ5QTY2MzItRkVFMC00REZDLUIyOEQtQjRBOTk3MkExNjE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBQzI0NjU1Qi01OEU4LTQ1QkItQTA1QS0zOTJGQkEwMzBBMkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTEyNjg2Mjc3IiBpbnN0YWxsX3RpbWVfbXM9IjQzOCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9D9A6632-FEE0-4DFC-B28D-B4A9972A1614}" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1844.4992.14501828670981640363⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x68,0x7fff924d0148,0x7fff924d0154,0x7fff924d01604⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1616,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2004,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3276,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4384,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4452,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4380,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4368,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4212,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4552,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4480,i,1367172429271053762,6991388219933241753,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BD994AA75DF24DEE087B06A0137A6E762⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E996E64D47E1C1651C18A5AD331EE1E92⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3F11B71A5DAB4BAF07BFC47D0A02F2D9 E Global\MSI00002⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUQ5QTY2MzItRkVFMC00REZDLUIyOEQtQjRBOTk3MkExNjE0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTQ0QzVCNTEtNjE4OC00RkQwLUI0MDYtRjc3ODU3QzgxRjNCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlFFTVUiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ijg2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTIyMzM3MTIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1NjcwNjU4MDAwOTU3NzAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTE1OTY3Njk3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\MicrosoftEdge_X64_126.0.2592.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\MicrosoftEdge_X64_126.0.2592.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\EDGEMITMP_04ACF.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\EDGEMITMP_04ACF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\MicrosoftEdge_X64_126.0.2592.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\EDGEMITMP_04ACF.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\EDGEMITMP_04ACF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D86BC560-E8CB-4543-9C30-CF2E90C021D0}\EDGEMITMP_04ACF.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.81 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff72fcaaa40,0x7ff72fcaaa4c,0x7ff72fcaaa584⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUQ5QTY2MzItRkVFMC00REZDLUIyOEQtQjRBOTk3MkExNjE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2NkU1RTgyNS02NUY2LTREQjgtQkVCNi0zNDVGNDgxMDg5OEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3R4Z1VCSG9vNkFRU0EvZnlFNDhzeUVYcXgySisvcXNxbEdXeGk0dWZIWWs9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNi4wLjI1OTIuODEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNjIwNjE1MDkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTYyMDYxNTA5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTYxNzkzMTc1NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMTExMGJmNjMtYzZjZS00NzE0LTk2OWItYjMwMjhiNDQxYzQ3P1AxPTE3MjAzMjk2MzgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9bk0xMlpoRklYZFhFckRYQUhZOG03eTdFRWR1TjhCVTVkanJ6cjkzTGFOakhNYW1jaXJUa1VLVUd3TE5xWFZaMmFickZ2ek1uV0ZPREtMJTJiSldYWkQ2QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MzA4MjE2OCIgdG90YWw9IjE3MzA4MjE2OCIgZG93bmxvYWRfdGltZV9tcz0iNDE0OTMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjE4MDg4MDIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTYzMTY4MTk1NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjA2MzMwNzc4OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjcwMyIgZG93bmxvYWRfdGltZV9tcz0iNDU1ODciIGRvd25sb2FkZWQ9IjE3MzA4MjE2OCIgdG90YWw9IjE3MzA4MjE2OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDMxNjIiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff99079758,0x7fff99079768,0x7fff990797782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4440 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5068 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff736397688,0x7ff736397698,0x7ff7363976a83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5044 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2928 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=888 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3916 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2380 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3168 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1816,i,17115829070095775494,9619367728374051889,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzFFMTY5RjQtMEY5NC00RDcwLThEM0YtRjNDQThFMzExNDEzfSIgdXNlcmlkPSJ7QjNBRjE0RjMtMTEwRC00NTMxLUIzOEQtM0E0NDcxMEMwNTQyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGNEFGMUM5QS04RjM3LTRGQkItQUYyOC01Q0U2RUJGMzBBMzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3R4Z1VCSG9vNkFRU0EvZnlFNDhzeUVYcXgySisvcXNxbEdXeGk0dWZIWWs9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODcuNDEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC43MCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNi4wLjI1OTIuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjM4NCIgY29ob3J0PSJycmZAMC4yMCIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY0MTk4NjM2NDMyNDExMCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MzgzQjZGNDMtQTQ2OC00ODRELTk5N0YtNjdFQzAxRjNDNTY1fSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e57832d.rbsFilesize
1.0MB
MD5ac0ea7b20947a35b69d6241d1115f42d
SHA1a28b01b3c9ad822e2d573f38a87897a1ab41ab25
SHA25605034b0cc7978bbe6845a3b0943524640758c886862004003fcb8c6796a6afb9
SHA512eb1bfe711d55ac065a9a190fe6b7409351a7afb0e69ca6e53f78da85c1b3e16c00764e1761e91b34826fd8e8235361f6abd5113ddaf3c638857fa36ea3654f33
-
C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Installer\setup.exeFilesize
6.5MB
MD57c44a5cba89f38d967b1f4e11225da0f
SHA144837f2ff9b3ebc7c371ee5f9e0cd5dcaad508dd
SHA256a10c3e0b2ec1286bfe6b3fe9005a9132fad01be9afc4bdd5adb29f174b8fb706
SHA51225b4cae7fc6d200dab70e94461b7f2e7899813975cab498fb367a32aa2e187fb7b1330545b60f6340d53fe5e04a1ecfb5d6b8bf004ac26ecaa7a8f6e387dfe99
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\EdgeUpdate.datFilesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeComRegisterShellARM64.exeFilesize
179KB
MD5687ccc0cc0a4c1de97e7f342e7a03baa
SHA190e600e88b4c9e5bb5514a4e90985a981884f323
SHA256ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
SHA5124da91ee55de7abb6ce59203edd9ae7e6fcacd5528ac26d9e0bfbd12169db74758a9bc3fde437e3c1d10afc95d74b04b0e94586472b0a0bb15b738f5e6ec41d8d
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeUpdate.exeFilesize
201KB
MD5e3f7c1c2e2013558284331586ba2bbb2
SHA16ebf0601e1c667f8d0b681b0321a73e8f4e91fa3
SHA256d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
SHA5127d4fd7ad06b05d79211144cbaa0047bdb4910212565b79f292a6bea652735dacf69435b24c73bc679cbdad4207f6352726eb297a1e7af4f7eef14dbc8a2ca42d
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeFilesize
212KB
MD5a177a23ca2ed6147d379d023725aff99
SHA11a789e5ef7bf9f15f2ccbac5f9cf3750ee41f301
SHA2569c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
SHA512c508ffd3e2cc953d857a2128e29dfdfe0f9e729da38c9cc3022c4376342aec946c6e79176e7885f6637008573c85339bdc8a9e261b3811887ecf5a7dd78383c3
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\MicrosoftEdgeUpdateCore.exeFilesize
258KB
MD54f840a334c7f6d2a6cba74f201e83a7f
SHA1cb032c7b1293190f8f1cd466f6ded4bbe71c47a1
SHA2562ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
SHA512575c20fcdbebb16bcd17a137a656769d355a81817e7fa3743981976998e00bdf3ce42bbfa046c42a835e9e9e7a10ef6f8d7b306de9940fa332817cb2885db833
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\NOTICE.TXTFilesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdate.dllFilesize
2.1MB
MD51125e435063e7c722c0079fdf0a5b751
SHA19b1c36d2b7df507a027314ece2ef96f5b775c422
SHA2567d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
SHA512153f096af5c874c00a3c38602fab590eccf885f642040007b67799ef39d919d7cb261fba43a9ffbd68c8824eddea219505d49e05b3dcc70f00e6016a1fbd12b9
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_af.dllFilesize
29KB
MD53a8fa737407a1b3671d6c0f6adaabd8a
SHA1b705b27c99349a90d7a379d64fd38679eed6ec30
SHA2565995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
SHA5129872f32a727b248d3edafe303e5290e1bae0c270a988500424221970c0041268c1626ebb94712a0b8ba0f21d2f29d833ab9dbc4db884f7f9af5a5063f94d71b5
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_am.dllFilesize
24KB
MD586465afa3ac4958849be859307547f57
SHA19bbde5e4df719b5a7d815dd1704ab8215602f609
SHA256921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
SHA51213e178e317280cbd585261aa22a840ea2203d4ef5c845f4fd6d5b4fbf216d45aae55153aed43c1fe4284d45391c72e580e612347b2903effece8a2252a13b90e
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_ar.dllFilesize
26KB
MD5819e3c9e056c95b894f1863208d628a2
SHA1596993f5d21cfd92f29e2ea5b0a870dc2ac19917
SHA256588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
SHA5123a7e67248895ac2cbb1874514bffe62a23cdfff2c3674d21589f528ec283ccf3cc2e3abfea0d81f49046c7ba920f3e64cda100c5a20be69b91ce05095b50c06b
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_as.dllFilesize
29KB
MD5d1aa2764e05f7c8c88a17bb0cd25b537
SHA12bee78f103faffe3e25ca20c915cc6b46e2134e4
SHA2563dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
SHA51280762e4611b8ac451490e5238c0650be048bf315526ed405d9c5837e5002bd6a9526f335a06c6baa009cba671ecb0613c76dce23086e13333f332480cbd9ced0
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_az.dllFilesize
29KB
MD51e4093c3b0af3eed6f95d2620d45bf40
SHA1e29a10ede562f2d057d6fc04c3a286996051a14d
SHA256afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
SHA512843480e2d2b431f32892830c26fc3e4b80656d069f83f9a9df78d10b1e22c9ceca99171360b2baa921d156995d87ea5223f18b11e2a8ac18fabdf905881940b1
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_bg.dllFilesize
29KB
MD5c30674009659b56bdb6a60f8629f0eb2
SHA14b6fc6ea93620a206a621875513455b57fd24e83
SHA256d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
SHA5128947a9bada21ed2e0f2cf080d58f9473a5c54092a5c1f75ca9523b48143caed346e831714e80466cc2e88513e507aef422d8560b69cbf8663eb21ab05c61707c
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_bn-IN.dllFilesize
29KB
MD5a8817334810c093e0c280e2a61caf36b
SHA19b3b2a8e33de3fa8df0b6b6ab4a40ab1d088ab28
SHA25618d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
SHA51224ee9a0c29d42c96ccec7f4f3322c3b6a2ed0e4d68b17a5b424a364f789adaa8f1404784c8feae77986cd0be39579dacc9ca89a3fa868bb0bf11d94c95f0bb23
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_bn.dllFilesize
29KB
MD54d2988ce0b2cf5cb02269a2455e1174b
SHA1d89cd05805965648c9e7b8bb4bc8bd3605ce2d4a
SHA256cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
SHA51264cee7e579367faca4864ebb5feb9dee310915f8640780a5a52c19f5c68d817adab7ef357913a68fe841a3b2e801e85de173a37402cdd49cf35319571ff6ce44
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_bs.dllFilesize
29KB
MD53e817089a18c72bd505dd6bbe5ce6163
SHA12c21b568c2fda5e475a1a996b73874ba6fe420dd
SHA2567c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
SHA51220534eee7c59a9cdb595c3f6d01abc8cfa534aaf84a693d3b011e4dada3fde080142a95ba036270a6a2ad2b65e6fdb18b08e53552715cc4edfcb87662fbf8100
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_ca-Es-VALENCIA.dllFilesize
30KB
MD5e0de8c3f8252202d2f68341290c45e34
SHA11d3322ab111774484be8865c1893dd834c3f52f7
SHA256ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
SHA512bb22666ba675c88715aa1b906f2b356c0d4289723052b942f416d3b56f727666f4fb8cc51609ca96be0c76ffda85cfbdcea917979e8a1ada5a5ba1b82e5bf816
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_ca.dllFilesize
30KB
MD59e4ddaa68d6d4f210905092096051b36
SHA1f38198c364da7b5ebcc75aafdf42a7d55699d8d4
SHA2568bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
SHA512d65102c0f4337cea443c5f8e65531f0f7b628c5edeff17257b427d1073a1b291d1cc90fe46dc4bbd2c2988f940480d46e5abb2cbb9985bcbafa7e5f3bc727151
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_cs.dllFilesize
28KB
MD5731cb513cd866dfc65e12446a0d4d62d
SHA1be32570fb7fd50c43cf1ae24e7a35302eb5278fe
SHA256829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
SHA5126357f965c183e89e5a1c485a0e3becf56ab91265241568d7df7fdc1c01f1ac8fa58bd206762ada8cec99b6988eff60c41cf4836290d5e007fff63a69a78de68c
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_cy.dllFilesize
28KB
MD504ee3ec0e73eae42509bdfb689927610
SHA16176e7ae836dcacea10f7004b04ba85e3e081da8
SHA2565410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
SHA51289c41d77066fde1cad219603d1bbdd812a65bb0680d3c545ee4cb63135486296f1af934a69161e76ca53d00037729e75bdcc22a2eca954eba98cf3f34af5d839
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_da.dllFilesize
29KB
MD59fa41c3ba8bbd84e85f71c3cd377d90d
SHA1363c1d61c84fee42987193e8edeffa522eccbfdc
SHA256157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
SHA51234569a917bf08ac7d50add115b09cd8bf4583a3bc7652fa54c1cd606cb94e752f4e4e278fbb99ea1e41e2d712f82893ca5f59bbed05a57c8d29b2d7037d835e5
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_de.dllFilesize
31KB
MD5896c0f7b03a6cd211fea53ecc71a1308
SHA1434eac60a992ea77945a77964050a5d0e41d48b2
SHA25684ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
SHA5127d2f9fc0086b3dc60275c6a2e17b0562626a57fb080dc1bc4cd5ad80c2501f366e89533aa961613eacd3a0bce343bf831e8cfa3d3a691c33481042b1ee02908f
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_el.dllFilesize
31KB
MD58cb60db631b0939688f39e76564505cc
SHA16dee577de716460737f7a330f440880b4e73c5c8
SHA256e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
SHA512d43216c1a8ed2daf51d70d476b789a3797bd62f69c1a556e306dfccc41efea73117eafb970010d7db151cd3ebfb7cd82de01efb4e2a2c0757b2027732a3361f5
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_en-GB.dllFilesize
27KB
MD51b79536b20df86a2bd8b232abe07d533
SHA1a9d24de616055f9800d5c4bc902cb2d0f625d178
SHA256fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
SHA512ac4704fade4879992f0a67888e1e4098be2879e5e3ce2bd80275ce68729f0037497d975e1ececb587ace4d72f3e71b038f616725831d4fca12280d583cd77d7b
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_en.dllFilesize
27KB
MD5a430ce95b80c07bb729463063e0c7c48
SHA1cc488bdc18c191d88dd93e45bb85fda19d496591
SHA256c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
SHA512cc9c24b95d079a949a8e725002494b0c75c19bce9ec6457cb4307f5803b7433eed738944f1baf770df8e034212224b1d9662fa533aa5bc5c01568d192fa49efc
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_es-419.dllFilesize
29KB
MD531177139af7d1da131c31d7d5cbe8099
SHA1113f3b38baeab35d2d0f51f1238f5b9e11402f26
SHA25639e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
SHA5126828a1cab2fdefe642a0b58f47c31e02b9dba7b15ad28cdb8039b194d9a86e2d24ff0e658fdf982e3d2d4208a2b57eb7546136e4739e64d714939c14a3d58410
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_es.dllFilesize
29KB
MD5dd3dd031e05a54c4bbf6660dd8053608
SHA1f32870bb0f7f522fd536c4ffae8c39c9d2f266f1
SHA2562d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
SHA5127b0bb0ae619baea45cddab042d10d7e4b394c70a29c01632585fec7ff9aaa54a50a8fbc894f02af5e2130cff11c4573cf41ab6b5fc4c29392b69e72212c41c2d
-
C:\Program Files (x86)\Microsoft\Temp\EU1A3A.tmp\msedgeupdateres_et.dllFilesize
28KB
MD52e1b7c75e1ee567906a62eb19ee4308d
SHA110b77bc1040db4a3712a94c2e5ba56be3a54bfd4
SHA25683a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
SHA5129bcbb626945390ca07c99b4a698036b2a59869040944866edb893f4e5f7a6524b8980183f9825b33bafa41b10165b7ef6d20dd7750e38edd880fc22362110c08
-
C:\Program Files\MsEdgeCrashpad\settings.datFilesize
280B
MD5e34b15b56a32ef2df175c5d72458cd2f
SHA1e31c1d5692b51deb716999ec9d2013168ce3ef79
SHA256abb5aacd519f6a32cd4f2dc6d0243e3a7a828a7ac3a0c4d9b0ece752e45a9749
SHA5126fdb7acd4287d290b79f1f0a92ccdda6ef5d1b92b849d045099531b06bc3496e85077c3decf636c9e6847998bb5849f6d689d957fc92d35f8a525854b7b3f4e2
-
C:\Program Files\chrome_Unpacker_BeginUnzipping1992_1793778662\adblock_snippet.jsFilesize
2KB
MD5f5c93c471485f4b9ab45260518c30267
SHA1ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA2569aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
SHA512e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
-
C:\Program Files\chrome_Unpacker_BeginUnzipping1992_1793778662\manifest.jsonFilesize
116B
MD51b8cb66d14eda680a0916ab039676df7
SHA1128affd74315d1efd26563efbfbaca2ac1c18143
SHA256348c0228163b6c9137b2d3f77f9d302bb790241e1216e44d0f8a1cd46d44863c
SHA512ab2250a93b8ec1110bcb7f45009d5715c5a3a39459d6deead2fbc7d1477e03e2383c37741772e4a6f8c6133f8a79fbabc5759ff9f44585af6659f9bb46fbe5d6
-
C:\Program Files\chrome_Unpacker_BeginUnzipping1992_2029411996\manifest.jsonFilesize
132B
MD5e2e0e30a5061d2e813d389d776cd8ffd
SHA190913c06260b62534b42c0e28bac3082cdacd19c
SHA2567f8c92b4e9da2afa5a089e37797036d18e61e4f02a4885b7887c0b98d464259f
SHA512000727f5052c846e39c62ae90032db500708e5fec5af24b8cc1f3a9d4102bc7b9be025176f01722a7c72b5e8bf85b0084cab0ebeb00fde03928c4e22869c98cd
-
C:\Program Files\chrome_Unpacker_BeginUnzipping1992_478892180\manifest.jsonFilesize
79B
MD57a74e28cea0b1a8f1969ff4ef4430047
SHA111cbf0dd7060e36283dea377fdfb1105068eddda
SHA2568fd032d30c7b9340e45428cfef8aa409a5df1f5a89be46ec0ab92e7ac53cc2ca
SHA512f5cb2e55c0ef4e56fa12bfffe78829109214aa213c193da2e75a51d6bbf5bcaef1e74bb40e091abfded7bdb076b2c266212abeb05aaa87f4cfda804f581c2b0f
-
C:\Program Files\chrome_Unpacker_BeginUnzipping1992_957402201\manifest.jsonFilesize
102B
MD58062e1b9705b274fd46fcd2dd53efc81
SHA161912082d21780e22403555a43408c9a6cafc59a
SHA2562f0e67d8b541936adc77ac9766c15a98e9b5de67477905b38624765e447fcd35
SHA51298609cf9b126c7c2ad29a6ec92f617659d35251d5f6e226fff78fd9f660f7984e4c188e890495ab05ae6cf3fbe9bf712c81d814fbd94d9f62cf4ff13bbd9521a
-
C:\Program Files\nodejs\node_etw_provider.manFilesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
C:\Program Files\nodejs\node_etw_provider.manFilesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.mdFilesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\licenseFilesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSEFilesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.mdFilesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSEFilesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.jsonFilesize
1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSEFilesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.jsFilesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSEFilesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSEFilesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.tsFilesize
4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSEFilesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logFilesize
15KB
MD50a2d83eb97ceda7c7c2e34e5111a58d8
SHA17fe74bb04c4f22e436a109823180fe4d3db74fec
SHA25625adaab98e4efb833c2dc00b1b58387b58910bed61317f688b0eb0471271668d
SHA512bfb684d3ed3dd4c9931d439572deca26d070d46820488b063912e2c088657d19ba646ab00a3cfff28a0bb0106941f92f35ea4585cfb581849ba345fc74923277
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.urlFilesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-indexFilesize
2KB
MD55aa8631067fd04aefbda52512d08b9a9
SHA15a7c489ec7147a0e7d9caf3b39ec749e38ac0887
SHA2567a7afeb09259636c315e789d1197f3986d53ffb53a0d1985f80aaa79ea9b1d8e
SHA512f707b0ba369dac8b3a6e545e257f76f7a55198837366d446ddb67c65a8b7851888200f7c314e91cd1b2b0b27cb751bdd9f952f58f6397d6ab8c868c315651b01
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5c4d46866b7bf5224e8a6ec4fde52e6c2
SHA14a5689affba0794a11c6f1cd300c289b576b1352
SHA256925924d40f584e2366bc209eb2c3f74c11d8b1d8d38e1ebb5a7ec86f9b58f22c
SHA512ec9884b533c250f9a8f35e6920d0d9d21968892a005b8d72f2b0e9db7c3188b8242dd5739e70744086c8cc1495c54720bb6b2d2a3eaf7167b0a0ef9e64d5e5cd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
4KB
MD5ac717dcd5368b766c61664a3e78f77a6
SHA1e12e0ef1d8dad27eeae9a2ed9bf82770f0c7a4b9
SHA256ee85223ba90451d0811904515dfcd4e6c9bae03fd799450db41766e9feab89e9
SHA5129a6ba4d5be18069dab3d10cd27cd1e37d321a0570ac1fa7c0137e41f7fcd1cca147313e8b6b898fd9dbfdd7c030b5f8b338a7e6adc0319bf3cf601547330bfd0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
4KB
MD58ce6359b1c71d7ceef3906b731d772d3
SHA120587e2011150b5d22ba754ff26e40adb125cac6
SHA2565f5296b50d4322b9846309544223a861e9d0fd8abe2135fbddd6b01dc8eab8e9
SHA512c3ecae6ee60dfd434aebec3eb7ddb90baf38167c25c0048293e3301695c6c239e663192ebc16e6fa3de2ac783e821544b29201d08fb6bdea8e9d1709e4af7a70
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD577526733fd9c7bf3a886f0162d60caad
SHA1ef419b52994ba815b30d927cf159bf5350b77985
SHA25628281ca8526a911ba622c9f764785042180869849bf0849b202c15e12584a7e8
SHA512e210444d86043b4a407da11512dab73cc4bbfbdf2ccaeff662f7137e3e54657ab1b449a6ef94dd653395eba8db7541afcc81f3286b47d224308829eedf524474
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5b4f8bb6da2c68f91e4a4600dbebdbc78
SHA1d0c295c00c3fea899cc744529c128b6a31c6c06f
SHA25673b9483cfbbd378a324a0900f635fed73af5530db0cef09c60fc0c96d43baf9f
SHA51262af43a7b2d4e236b5c4adabe7a0b2ce4d463014692b1abdc93a4efe676d357851775f321473e3518edb4186f8030f89ccbf7cea2b4181992753c00273d25da7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5e792a1419147a37c7760e7e8a4ffd610
SHA1447e62e5f73d4c8c6a0a6c22c1072b7420a0beac
SHA256e033d5e2fc9cabbb0f373e5c01df381e48ad44f648b2945cd94f194ea879a678
SHA5122d1a436dddd5b2ad922f0df57b29cf991b025c5085bdcde65bb7294bfd612d918054cbf8b9ba71b14a1316ea9c700b2e3e5ffea987a3bff2fc2747ed0b0d179a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD52064ac716af3b83f63ceaa402f512a5f
SHA19b6391a392b0f07a23168125593330bcdd50cfb3
SHA2567e70ee7c191dc819f4e6d9993a83109b6bd53e71ae0aef0a907d28bfafe3914f
SHA5128554ec0d0f7c21ef876b7b94714bbc9c0e87fc523ff61d8dc92376b50bb2abde60a5e794dc1e079e75eefc6928ce646570ffe2c094f6eb2823d0a08d22e24903
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5d952ad5dc1c88d35bd4cba189af3a1f5
SHA17478285fae2328ef7674e19bbcd5fc4a855b9c33
SHA2560bee3090440c46b9e6bdb9bc69d1542cfac609d8880c25a32209a5c2a861070c
SHA512ec627e1a116a0f2430eae18362d331b79c987cf25512a04347340ca6a724cbde55f80d2c877b451bdc45533024336c8b7ce5a890a2349c08480e9bdeeb42e403
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD553b6a8c7b4f2392916d04a9a184240cc
SHA1c89acece5c3af88dea9faebb15ede72ef17f3e8e
SHA256179a142d873ba9f02fe813d301f9d933ccd9d8ebfc10ab6c968addc581785bcf
SHA5129ff31ab1fdac4e314b42888ee0a721687d9e297af1f36c324c36a65204921656b96637b113cee9ca3325e9ebc99f6c8c7e1251f80422aafe37be5ba4eaabd3c9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD53943e04c3f6ca24caf6f8e0bba7a556a
SHA1dc7be1d9c6a7ad36856ed58955f5e2ea1db5103c
SHA25662493039148df10a108d79f47b5c3617d1615a4e16ffc266c65d04d13d91314a
SHA51212ecf3c17e01a21e6f0943930df1efcffcf65934c24a4aba833346a7490e3d36c6b792914e09b671acf1c4506de0bc5c667a7cdcd1d69dbc998c1000037aeacf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5c85f2f0a6abd899669362f288aadd7bf
SHA1699cb0fae603c5277114628beec9baf68f107733
SHA256e0df184c998b541618151361383a52073438792812ad758fcfb8ab6774f3e605
SHA51242f048b7daa11359ee837735b64ed7c12a7ab2cae66b1ea98bff692d84e62c54f9d66d06fca41859f3a2ae833e9b2bbedc805b3feb850c32354276016ad92def
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD58627f98b9ea4d70cf95fb544798ae40b
SHA1dbc4c7ae0e65982e18af03ad7abfaf71782aa971
SHA2563c53473068b5abad79c6dc354eb901bed1ebb58b4c52a9b89fe35c0b48177223
SHA51258eea8367d0b85a9716f5b8eed0c43f7f2567b44fd21bee9bcf55eae1bb570773f092308d3a2b8ca72ee423079d0ee1b5d98c7aa0c75a6ebee301b08eb259566
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5e676815f2d9866e37190d09895cdb3ce
SHA14ebed38ce89a19d870c9a4617e36bb206f55637d
SHA256b117ef6275f4758984dfc9dafe9a0a15e76fc9ad16febbe935886ad6e1ae8f6f
SHA512fb8bdd0b7c2057d786c87034eadf5cfab635ae39e60e3f0bba247bf902973df88b8d142eda995c637e466de18aa2770fd7ef78c51eddac0f02577615bef842ae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD526210528a85a958e0044288271fa541b
SHA1f9c5e97d3fc708e60cd54c588b35509c3f23f466
SHA2565641dc5da9cfea275386854af782b2740f6e2d5238e746328742f099ec777c82
SHA51206bde7063c20e9df7f013c85e9e07d6ad7ea302b04083ce726f2c7ce3cfa6b02fdcd0c16017ac3a5eda3791ed456c559b5ab074bea0da4faa17a94b9b8c2fa0b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5d5ec7313f18880aedcd13ca220f5ed7b
SHA1029c8c75cadcb0e2c7f1f167f0cd0114b6af2ef8
SHA256ed7e183a07c2f1107abb30d7099be2fd23101ddff05b86094f7c5b40f452fac8
SHA512dc3ca9a78ad4e476aecd4f0c4d140008e4d63c672de5883cb271d94422e7c46ab7c5ea629b96db62b6f4739b8a9674bf0a7642bb376fa4ea84f77c9b0f1b9d1a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD544f79616783430a49562feeb2df93e68
SHA1fd29749018b476c7f13cd1a5baf40b40a4ddf186
SHA256870ca21d19ff8731811e99ede015547fa9b6f5f8aa1eb1d087eaa60f36af042c
SHA512b23fccd771808a4685f56e4c6ed26f666c4b2919cce011654dac081bb17f57ae27e07a40c59d3ecfa7a4d9e22a46585ca6967959fe342584c772e5c18dfedc88
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5ec470e9af6e0035e25f1a3ea981afa66
SHA1975c928bcfdf74478a5b631cb68ca2a7ff07742d
SHA25600590defeb904efacd1437ff2080676c60966faf3c717f2347cd8d5d2244ab3a
SHA5126a19a9f20ee352ac5ab89c4071dacf8a4e537662ce4aa8dd72c17e7aaff8034032eba8e15abcfcb8aee0fdb4eacadbea3528a4e5c52afb21aee89ce7553e20e8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5495fe29d0cc325f581fd7ce872c52c93
SHA12fee8abe6841fabceef19280b784d3ec39d8e963
SHA256ec3a945f6ba2e82160d6ab49ec4b9e5a290f113db4dd4a305e8e4e86dd98b1b9
SHA51292c1f8064ebe10cf3ff25578a668fb4f4bb4d1ac284b3429225a1772c13567b0bf9bb2fcd0c96655274224e2e31e100f30f06e359458f2a470e64ae01b0c42c2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
310KB
MD5cd767707d2e14b52794b92cce5fa79c5
SHA145d602cd7a8df703987e3ab305c7eb9b07027519
SHA2565278e4dd6bd3a62ba8c1daae45aec39d89c955b4b53bc3d494be461b10022f72
SHA512a22d2ff27c42e4317adae273e6443cc5b4da73fd1261a3a8fcf27ff5dd20538221b5c29fb39624e72cad80c3797177d4e5a531b7fdabcf10919af476559a08de
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
291KB
MD56f8cb39adb901e39d31e772e53c8c25a
SHA17b13b3b17383e8ab7855da047323a8cdffd2d482
SHA256f7c1d63b15a592d4fd7116a532d0ab02e4703603f22db78608fc10d957107a55
SHA5128fbf652df95df6ecc9d0979016274c4fbade5381061824bcb26dcb86af0d648345082a5471f73897dbf9239a26d835324db98d6c139d004cd143e2b4f169aa56
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
137KB
MD5395575dd15027c01c250c8a897a2465b
SHA1d107b1a8f227ced437b19fcd97c42f895a166e10
SHA25690bb591f5abff7bea57568f8546bf1ade37ef0e27e8e7fa05bad5c10769bfe5e
SHA51229211ebe98db11c1c8f4718550b18bdac7baed7d13e3ae28f01c66feedee0c7619b3b6dc6d6339331079d5fd036a47db8c437fa6e814498c22c8b7094f2b07ef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
290KB
MD504ca8a8080b17a21cf96f26e2cc85f00
SHA13fbb51fe220c135f8a19c0494f3a6de6a1cb5a9d
SHA2566797d63175b9a572ab0a36f826f4c6d6ec5b781f11eb0816685d208b9c8d098a
SHA51245f963d85fb4cafc97e329664562531ec240e082b7d7472112e9d393f7bc7fb4231fee36966995dd90b7b1690c304cdaf09ecc4b25c79e888ef98d74e9969856
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
97KB
MD56e65bb8dbc00ee53e04712bb1e198fca
SHA141c207c4e8174cfa4ac8c1e48bf03015df2a61e6
SHA256f14a7d2bfd6b8b877020e7f0f856a50d7c1a39b1246a8968729d03656898ab56
SHA512caa1a0285aff452ede51e9d7f4ed4fbf140cb0b6e7d8376bb27caa7cd71eab613a97f1ff979cadd8644076eb812190330bd544db7fcd9d0d24a63e5564315fd8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
101KB
MD5a30f1244c3cff32af9f9d0975afecaf9
SHA19e9ff70821325e49ccee9ee6c3ee7da5bbe98d75
SHA2563282a9768b0e16cc4ecc3037253469c505edabbb48152b14119c703a18147f90
SHA512c5a5853ced1c2ac62021f916d334050b0aa9c8c60d2c7c58777805bbfa17fc5b65282099a342f0f7629b20a1ad362c06585d9e5265966304722f4ea75f14c8a8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
99KB
MD5c6d78764948fd40a72e59f96852afde0
SHA180ef542a0ef5e84b811c5646a1c49b825a62a93f
SHA2569bb92382d0896161c4b472a388d779e919f40a343e6f3d5e89e59e4c7fa200b2
SHA5125bb799ba619324be7540eed9c76b7fffc211d5e81c0bb266b3e6c29c22ea6a8e9ddcf70a18aae34370320e52c0acfaa61d0b4ffee8c707e4a702e5f3c62de365
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5c02b7.TMPFilesize
93KB
MD575f5c8af7d97be8ce2a917b3841421ce
SHA14783abe32a0682e00e622d1815e5bdc53b22453b
SHA256099b5b70735f5b89efb5b88110836cdd60efa81e782c9118acf867ff7bde0b84
SHA512859d0f58503051aada3544d1bfed03c6ecb2220968784dc95b0a5777ec5bb3cb3a7cc40cd7d3f17da0c21e7e15453082b5de36a77732cafb18e5e4e5153808bf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeFilesize
1.6MB
MD5db7fb67fcec9f1c442de25f3ad59f50c
SHA1b600aa26d1cded59760304c6d77f4ff75722eabd
SHA256c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
SHA512c14ec7d252a6f201dfea476d302fbc5140713cb4ea7bc8d4e610bfd806b3fa3c141153e2e9b8cb36255fba1fab4d4400ed83f5f5c1228d77d77bace41d5de7fe
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrcFilesize
139B
MD5d0104f79f0b4f03bbcd3b287fa04cf8c
SHA154f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA256997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
SHA512daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrcFilesize
43B
MD5c28b0fe9be6e306cc2ad30fe00e3db10
SHA1af79c81bd61c9a937fca18425dd84cdf8317c8b9
SHA2560694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
SHA512e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrcFilesize
216B
MD5c2ab942102236f987048d0d84d73d960
SHA195462172699187ac02eaec6074024b26e6d71cff
SHA256948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
SHA512e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSEFilesize
1KB
MD513babc4f212ce635d68da544339c962b
SHA14881ad2ec8eb2470a7049421047c6d076f48f1de
SHA256bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400
SHA51240e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.datFilesize
280B
MD52d4697baff3288d26f566cb7c4b3f3a6
SHA124539ac5eb0f1171a078d2af4402226e372cd64e
SHA256dc5d79863ebeb4261901ae10b2238bce79194c405c8fd2438d79719385a7bad0
SHA512df972c3ed19443dcb0b734f1d4dbd03951c7a1e034f2140a67cc5aee7f2e5c4f65b2ec92500b24a30c28915acd1076c76ec3e6e3306bccc9ac1f974d30879091
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\58157409-ce0b-41e8-adf9-2564c4680e77.tmpFilesize
6KB
MD5fd429c6e0b0888eb152233450044d3ab
SHA14c4c38fa4f7960db5bd6cc168f4e69d88a716a46
SHA2563f8f1c67321d87c5fd21bd39872dd76adc1c93fd7927bc7678a8b49dedd83ea8
SHA512a998d9516c54e10547fce4da874484ef893bf9348199f0c29355e6d7037faaa8f1204ebab549a00d2cd359f9c019d90baca8476dd7a3ac02b04a2ea6b954bd38
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent StateFilesize
1KB
MD5457b3ef95c79bd3055fc4b1ac74ee89b
SHA115a2e4c2bfbfa1656af5e7cb1139950b3f1dbb9e
SHA256593db6871fb533ba492d659b01bb343c3007074988c9680f1c63e69316532fdc
SHA512f0cd1cadf4da23e72670d229dbfe200e45475d33e0b90d902c1a19f41a3d82f694ef4b89e12dda76ae61d89aebef65fdd4ee031cc5ad9877e4a0827212b3f76b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5c4f6f.TMPFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\PreferencesFilesize
6KB
MD594fc727f4bb6e396ced13196dfa34570
SHA16c5a00d1c0428ec173d0696bf28139ce2121ba01
SHA2567f4bd637f930b3eecb117e84110f2a6fd5f7078e5fed97130ea2ec992022df6a
SHA512452062a28c94e2421c40383cf0b2d8e0d47aeafb95255a780a2ca9876d429fad2dd55afea91610975c5b032d6231e52446d27da50e3be38c6707fe0bed90da46
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GraphiteDawnCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GraphiteDawnCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
1KB
MD548be4a156dc5092485eaae45d718c910
SHA1e5c12829e34f03f0f845de1753892e40b4e322ac
SHA25669d8223b15d2975a11d821c0f6891ff46a5d33abe4ce4881c3d2a8b8657b8f42
SHA5121303084b124e912347f25b70db2b99cf425554b3acce811280049ac5eff1153795ea338bc08ed29c8f62b41903d0f66ea29a01f650b2fc99f4d3bcf25b9c473e
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
3KB
MD52ae02dfa2b3742bb96a762fbae1f7861
SHA1aa23fc3067fe6cd65adce20c6cf1ad606d15731d
SHA256e8f0519ae94278820ba9f2e84f590c75fd224c0d40f92ca6c984d3fa976b20a0
SHA512264e7714d50c241c25fc2bfcdce77e0657443ff306d8ab9186de067dd13b2cd0ff34e22ba0ef0156958f7360deaf01a0d9549231d06ea12bbef779d0f92cbb5b
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
16KB
MD5fc461a82b8fb725416a1b70250b681ec
SHA1f696be5f7c5867250fdd402ed27a2affea2c0312
SHA256b047b1ed20816463c008bb4e457ef513ddfcfe027848ee02ff272033db6d26da
SHA512cd699d63ac943462690ad76f1adc38e72b4332f0b42c986400c74017c216e543ff874a69350759a5b5c6503ca1e007674b9f1d867daa3cd4a6714b724d983a73
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
18KB
MD51630fa486b305a7b65c82c3051bdb8f4
SHA1d49a847e46da9474cfe04657ec04450b84c58611
SHA256666d0d608d2408deb5e314df0d16685b4d6d8076bed5aa2d13253a98832779db
SHA512dea35c70527dbcae46d70128b3867d2c82499612a5af210de1432b32a7ebe156fd8d84b1817ab744a30b6385cbf7e92aea3d9f77d1d22b3010897cfe9b583e36
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local StateFilesize
4KB
MD52bd87b6400ae788c3445309185edc4a4
SHA1a10272fd41c9acafeb81084cb5db34ff435bcfee
SHA256bc3864a845dddd6fbfe5d313cd15932f51fa26502419a044972206ca2130bcf4
SHA5128e2ead0a80734f60fd09e3ad7d8f1ce5bc0746fd83e5357b0ff878d7eb0ed57fb7375f2b6b2658eaa78cd6fdfb14e16b0793535aa9420cca6b33aea501975ca5
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe5b3c4a.TMPFilesize
1KB
MD5fb20f32b9658d8e326b25e92d1accd08
SHA12a63d3c8821a051820ae24510a1c96b4253e3a01
SHA2564dc436e95c9154dadfdbe8c18ebe8d4bdd577d0c8473a4c274637baff7d9f755
SHA512e8eb4bfa3b4e8db4b48f851428c7c58b4e28b7b47b53d63075478a09f7a8c2e401913d07926b4dfe279190f3c722534da9d51385669a77d79bb256181d2a7f0f
-
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msiFilesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exeFilesize
24.1MB
MD5e091e9e5ede4161b45b880ccd6e140b0
SHA11a18b960482c2a242df0e891de9e3a125e439122
SHA256cee28f29f904524b7f645bcec3dfdfe38f8269b001144cd909f5d9232890d33b
SHA512fa8627055bbeb641f634b56059e7b5173e7c64faaa663e050c20d01d708a64877e71cd0b974282c70cb448e877313b1cf0519cf6128c733129b045f2b961a09b
-
C:\Windows\Installer\MSI86C4.tmpFilesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
C:\Windows\Installer\MSI87A1.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI8C94.tmpFilesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
-
C:\Windows\Temp\{9F21F252-FC68-43E7-B697-D3C1DDA8A406}\.ba\logo.pngFilesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
C:\Windows\Temp\{AE13C7E6-2308-4A51-9B94-101EE5A1ED72}\.cr\vc_redist.x64.exeFilesize
634KB
MD5cb264f7d256b42a54b2129b7a02c1ce3
SHA1d71459e24185f70b0c8647758663b1116a898412
SHA256d6aaee30c9b7edeac6939f78f4a55683c6358d9cc03dac487880d01f18700e83
SHA5124f623f5d21bc216f3dd040e6d0c663a8ea37efe5d0ce5f4aeb1ef5c1f7c873e19d1abc979d3e40d4dc70e2e4f0fc9a1b114b17d9eb852ea9a41d0f84356cd7cb
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\Temp\{9F21F252-FC68-43E7-B697-D3C1DDA8A406}\.ba\wixstdba.dllFilesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
memory/696-4250-0x00007FFFB5A20000-0x00007FFFB5A21000-memory.dmpFilesize
4KB
-
memory/1244-2669-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2692-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2675-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2739-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2731-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2681-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1244-2685-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/1844-4215-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4208-0x000001D2ED890000-0x000001D2EDDCC000-memory.dmpFilesize
5.2MB
-
memory/1844-4206-0x000001D2D2E90000-0x000001D2D2EAA000-memory.dmpFilesize
104KB
-
memory/1844-4535-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4440-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4489-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4438-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4785-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4417-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4418-0x00007FFFAE1A0000-0x00007FFFAE1C4000-memory.dmpFilesize
144KB
-
memory/1844-4806-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4209-0x000001D2ED5D0000-0x000001D2ED688000-memory.dmpFilesize
736KB
-
memory/1844-4210-0x000001D2ED690000-0x000001D2ED742000-memory.dmpFilesize
712KB
-
memory/1844-4211-0x000001D2ED580000-0x000001D2ED5A2000-memory.dmpFilesize
136KB
-
memory/1844-4212-0x000001D2ED570000-0x000001D2ED57E000-memory.dmpFilesize
56KB
-
memory/1844-4846-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4226-0x000001D2F15D0000-0x000001D2F15DE000-memory.dmpFilesize
56KB
-
memory/1844-4220-0x000001D2F14C0000-0x000001D2F14F8000-memory.dmpFilesize
224KB
-
memory/1844-4213-0x000001D2EE150000-0x000001D2EE1CE000-memory.dmpFilesize
504KB
-
memory/1844-4214-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4219-0x000001D2F12D0000-0x000001D2F12D8000-memory.dmpFilesize
32KB
-
memory/1844-4217-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4905-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1844-4216-0x0000000180000000-0x0000000180B0D000-memory.dmpFilesize
11.1MB
-
memory/1992-4829-0x00000149C87B0000-0x00000149C8959000-memory.dmpFilesize
1.7MB
-
memory/2584-4356-0x00007FFFB5A20000-0x00007FFFB5A21000-memory.dmpFilesize
4KB
-
memory/2988-2668-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/3936-4889-0x00007FFFB57A0000-0x00007FFFB57A1000-memory.dmpFilesize
4KB
-
memory/3936-4888-0x00007FFFB49C0000-0x00007FFFB49C1000-memory.dmpFilesize
4KB
-
memory/4196-2393-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/4196-2757-0x0000000000E90000-0x0000000000EA2000-memory.dmpFilesize
72KB
-
memory/4196-1-0x00000000006B0000-0x000000000077E000-memory.dmpFilesize
824KB
-
memory/4196-2-0x0000000005420000-0x000000000591E000-memory.dmpFilesize
5.0MB
-
memory/4196-2392-0x0000000073DEE000-0x0000000073DEF000-memory.dmpFilesize
4KB
-
memory/4196-4207-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/4196-0-0x0000000073DEE000-0x0000000073DEF000-memory.dmpFilesize
4KB
-
memory/4196-3-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/4196-2755-0x0000000000D70000-0x0000000000D7A000-memory.dmpFilesize
40KB
-
memory/4196-2751-0x0000000000DE0000-0x0000000000E72000-memory.dmpFilesize
584KB
-
memory/4944-2667-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB
-
memory/4944-2750-0x0000000000E70000-0x0000000000EA5000-memory.dmpFilesize
212KB
-
memory/4944-2666-0x0000000000E70000-0x0000000000EA5000-memory.dmpFilesize
212KB
-
memory/4944-2679-0x000000006FCA0000-0x000000006FEBF000-memory.dmpFilesize
2.1MB