7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

Resubmissions

01/09/2024, 18:01

240901-wmcrtsxfjj 7

01/09/2024, 17:47

240901-wc2yzaxhpa 9

Analysis

max time kernel
242s
max time network
241s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperV1.17.exe
Size

796KB
MD5

4b94b989b0fe7bec6311153b309dfe81
SHA1

bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA256

7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512

fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
SSDEEP

12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Score

9^/10

defense_evasion discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe

Executes dropped EXE 4 IoCs

pid	Process
1952	BootstrapperV1.17.exe
4564	node.exe
3716	Solara.exe
2168	node.exe

Loads dropped DLL 13 IoCs

pid	Process
932	MsiExec.exe
932	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
3308	MsiExec.exe
3308	MsiExec.exe
3308	MsiExec.exe
932	MsiExec.exe
3716	Solara.exe
3716	Solara.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000100000002b71a-3200.dat	themida
behavioral1/memory/3716-3205-0x0000000180000000-0x00000001810ED000-memory.dmp	themida
behavioral1/memory/3716-3207-0x0000000180000000-0x00000001810ED000-memory.dmp	themida
behavioral1/memory/3716-3208-0x0000000180000000-0x00000001810ED000-memory.dmp	themida
behavioral1/memory/3716-3206-0x0000000180000000-0x00000001810ED000-memory.dmp	themida
behavioral1/memory/3716-3324-0x0000000180000000-0x00000001810ED000-memory.dmp	themida

Blocklisted process makes network request 3 IoCs

flow	pid	Process
11	4876	msiexec.exe
13	4876	msiexec.exe
14	4876	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
47	pastebin.com
48	pastebin.com
251	pastebin.com
253	pastebin.com
1	pastebin.com
4	pastebin.com
39	pastebin.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3716	Solara.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\bin\nopt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\theme-set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\pretty_sln.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\obj.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\crypto.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-outdated.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-columns\color.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\owner.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\eclipse.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-adduser.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\spawn.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\lib\advisory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-normalize-package-bin\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\typings\common\constants.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-pick-manifest\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmfund\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\is-windows.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\isexe\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSUtil.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-unstar.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\process\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrappy\wrappy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\dsse.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\legacy-streams.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-link.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\easy_xml_test.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\lib\breadth.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\mjs\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\binary-extensions\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\plumbing.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\registry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-paths.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\tag.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\dist-tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\.travis.yml	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\update-notifier.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\node_modules\lru-cache\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\graphviz.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\events.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\identity\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-version.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\profile.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\align.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\error.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\safe.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\unstar.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-star.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-styles\license	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57b91e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE950.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2F2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6EA86ADF60E81229.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF261E67EF197B1EE4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE63.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b922.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3A9AC0CBB667DA62.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSIC322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C464B1033FA1260.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC883.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC333.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b91e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEAE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC7E.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BootstrapperV1.17.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2148	msedgewebview2.exe
4356	msedgewebview2.exe
3924	msedgewebview2.exe
4220	msedgewebview2.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133696865515991129"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BootstrapperV1.17.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3584	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
3004	BootstrapperV1.17.exe
3004	BootstrapperV1.17.exe
4876	msiexec.exe
4876	msiexec.exe
3148	chrome.exe
3148	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
1952	BootstrapperV1.17.exe
1952	BootstrapperV1.17.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
4588	msedgewebview2.exe
4588	msedgewebview2.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
2148	msedgewebview2.exe
2148	msedgewebview2.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe
3716	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
2324	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	BootstrapperV1.17.exe
Token: SeShutdownPrivilege	4448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4448	msiexec.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeCreateTokenPrivilege	4448	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4448	msiexec.exe
Token: SeLockMemoryPrivilege	4448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4448	msiexec.exe
Token: SeMachineAccountPrivilege	4448	msiexec.exe
Token: SeTcbPrivilege	4448	msiexec.exe
Token: SeSecurityPrivilege	4448	msiexec.exe
Token: SeTakeOwnershipPrivilege	4448	msiexec.exe
Token: SeLoadDriverPrivilege	4448	msiexec.exe
Token: SeSystemProfilePrivilege	4448	msiexec.exe
Token: SeSystemtimePrivilege	4448	msiexec.exe
Token: SeProfSingleProcessPrivilege	4448	msiexec.exe
Token: SeIncBasePriorityPrivilege	4448	msiexec.exe
Token: SeCreatePagefilePrivilege	4448	msiexec.exe
Token: SeCreatePermanentPrivilege	4448	msiexec.exe
Token: SeBackupPrivilege	4448	msiexec.exe
Token: SeRestorePrivilege	4448	msiexec.exe
Token: SeShutdownPrivilege	4448	msiexec.exe
Token: SeDebugPrivilege	4448	msiexec.exe
Token: SeAuditPrivilege	4448	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4448	msiexec.exe
Token: SeChangeNotifyPrivilege	4448	msiexec.exe
Token: SeRemoteShutdownPrivilege	4448	msiexec.exe
Token: SeUndockPrivilege	4448	msiexec.exe
Token: SeSyncAgentPrivilege	4448	msiexec.exe
Token: SeEnableDelegationPrivilege	4448	msiexec.exe
Token: SeManageVolumePrivilege	4448	msiexec.exe
Token: SeImpersonatePrivilege	4448	msiexec.exe
Token: SeCreateGlobalPrivilege	4448	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4540	wevtutil.exe
Token: SeBackupPrivilege	4540	wevtutil.exe
Token: SeSecurityPrivilege	4504	wevtutil.exe
Token: SeBackupPrivilege	4504	wevtutil.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
2324	msedgewebview2.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
3584	EXCEL.EXE
4564	node.exe
2168	node.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4448	3004	BootstrapperV1.17.exe	84
PID 3004 wrote to memory of 4448	3004	BootstrapperV1.17.exe	84
PID 4876 wrote to memory of 932	4876	msiexec.exe	88
PID 4876 wrote to memory of 932	4876	msiexec.exe	88
PID 4876 wrote to memory of 1372	4876	msiexec.exe	89
PID 4876 wrote to memory of 1372	4876	msiexec.exe	89
PID 4876 wrote to memory of 1372	4876	msiexec.exe	89
PID 4876 wrote to memory of 3308	4876	msiexec.exe	90
PID 4876 wrote to memory of 3308	4876	msiexec.exe	90
PID 4876 wrote to memory of 3308	4876	msiexec.exe	90
PID 3308 wrote to memory of 4540	3308	MsiExec.exe	91
PID 3308 wrote to memory of 4540	3308	MsiExec.exe	91
PID 3308 wrote to memory of 4540	3308	MsiExec.exe	91
PID 4540 wrote to memory of 4504	4540	wevtutil.exe	93
PID 4540 wrote to memory of 4504	4540	wevtutil.exe	93
PID 3148 wrote to memory of 2828	3148	chrome.exe	96
PID 3148 wrote to memory of 2828	3148	chrome.exe	96
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 4584	3148	chrome.exe	97
PID 3148 wrote to memory of 2164	3148	chrome.exe	98
PID 3148 wrote to memory of 2164	3148	chrome.exe	98
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99
PID 3148 wrote to memory of 124	3148	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.17.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.17.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4448

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3ABF056B42C56AC4E98C21F5E481D0EE
  2⤵
  - Loads dropped DLL
  PID:932
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D85A0A84F1A1A04D0A8FBB6C8D17A8C0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87CF46AC56F9283A180B90475549E2EC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce1acc40,0x7ffcce1acc4c,0x7ffcce1acc58
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4876,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4944,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4688,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5004,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3156,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3304,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4972,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5384,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5608,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5600,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5628,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3444,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3712,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5964,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3524,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1080
- C:\Users\Admin\Downloads\BootstrapperV1.17.exe
  "C:\Users\Admin\Downloads\BootstrapperV1.17.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- - C:\Program Files\nodejs\node.exe
    "node" -v
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4564
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3716
  - - C:\Program Files\nodejs\node.exe
      "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" a9ffd64593544d93
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3716.4008.7358629262741924031
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2324
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x128,0x12c,0x130,0x104,0x1c0,0x7ffcb6023cb8,0x7ffcb6023cc8,0x7ffcb6023cd8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4356
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2516 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3924
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3080 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2148

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2052

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\CompareEnable.xltx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b921.rbs

Filesize
1.0MB

MD5
873c82f4a6cb20e3be77c7d204602986

SHA1
c387bfcb8e8c62cfb473e691f5dd1de01a44cda5

SHA256
6b6cea261d763210370c795bebf3275a0c6cc2b7189f0a1f318492e880c9ca1e

SHA512
411fcec535fb5c72557d83be8823aa30d7e4386209523229e5fd925509d5dfb68a712823a574b3a4795d00e26be93d7067d1e9cac51d0f5ad2034abcae5f414f

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\index.js

Filesize
6KB

MD5
0e709bfb5675ff0531c925b909b58008

SHA1
25a8634dd21c082d74a7dead157568b6a8fc9825

SHA256
ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67

SHA512
35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\package.json

Filesize
2KB

MD5
3b5b76b70b0a549dce72c5a02756d2a8

SHA1
07786baebb5c52882e28a8bd281c9a36d63dd116

SHA256
bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859

SHA512
bb266dfa725421fb26d26fda0f45a5fa5cd832667b05f27ceaf4e7fc1e032aeea8700493cfdd2941c3c38cd166eee1000d2b9ae3ddef375714e25a2027a943a3

Download Submit
C:\ProgramData\Solara\Monaco\fileaccess\package.json

Filesize
53B

MD5
b9f2ca8a50d6d71642dd920c76a851e5

SHA1
8ca43e514f808364d0eb51e7a595e309a77fdfce

SHA256
f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde

SHA512
81b6352bbabd0bffbc50bfcd0cd67dc3c2a7d63bda0bf12421410c0ec8047af549a4928b5c5c3e89ead99aa9240bddb461c618c49287c15d9d4d3a899e8f596a

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
ddfdd5ff817b39f037284d2f900de407

SHA1
8540c39f3c0d133ae7a41581a74183bb887f8363

SHA256
3bb95ce8e49260a0ad856feb3bc79fcb0ca94c866c8694c7e302f087e8b712aa

SHA512
18bb853a124c336870caece45e115c0865f9ce9e7ce3d6e994e9c8ba9789eaf8d6fc77aa17289531920ea8aef36311fa03405965aba0d5fdf4ec251c5dee778f

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
c75967549639bf2d5a3317dc2d597b4d

SHA1
a7ce356d548b787cfaffec398f60fb709c105d58

SHA256
2ea74f3d80281811e4bf4907c6861f76f065ac533c411e839e950c6425efae66

SHA512
d9ddaca2a432aac7293d1b76fc243f2efd384fbdb3171c8b16569d323e92b0ca8b9725ba1cb8e7065669d2aeea7cecf07c2e5a7779690cf8fb4720ef9c020612

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
763aaa5cf280431292c7ad22447eeb1e

SHA1
1b86f2ad4f00149cedddb583447d943ebb1e9828

SHA256
73159683846d81f77fa7447f4c8e522100cfe041ee9b52a8858a178e48614839

SHA512
b36b92e4a17a2564b37fac5022b059ab1336b08c7abaea0dd026680c6269951df966a19568769ef81051567d39d407e9a122727f1a9c1d5da0400dc6605536f1

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\ProgramData\Solara\SolaraV3.dll

Filesize
6.5MB

MD5
1462d874e5ff71903a531fab6bd4dead

SHA1
57ea11418a14005d5dc756517ade5791e785a86d

SHA256
35d5849f6af8ec79cbff70b4de6bcf86d9a5a6733bcbbaa382d87555c36ff1bb

SHA512
4169a607dfd37c268b028860bae184d360790996fe26ecde33e8d94fa3ee08bc0ff1b246f5dc0328e279e3279a0721c9d6373f0953038aa5ff1adb6d7cdc14ea

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\ProgramData\Solara\bin\version.txt

Filesize
5B

MD5
4e1aa466b3d6af47b4474ab22282d6f5

SHA1
4c967902d76815d00d9524411bd44c1f02417c10

SHA256
277714254c43ea9071d68ce359fee319fca802b6d6cc98f37f2fe8697a7e1b61

SHA512
ea5b23f04484d896fbd698ce3ac3a7b79f5ab4f661851ee7334213b83cac4b05fb32204b4238b9a41a571ed5de08b70c726c04ba3c00381fdbf852ad5e6ee1e0

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b2ce21e-f92e-419d-84ee-997945a5a168.tmp

Filesize
9KB

MD5
19e624c81778c234e63549de4a6c7726

SHA1
3316a22dadd8ce9b2c8c045000549a33da255113

SHA256
492b81462aed4875c25103171f3f6208e986a26afab2ba1bc1c100d1c8cc803a

SHA512
1e4bff8680f847c3d725cb7a25a356ebc5b726373a0d1f97cba0a30e02f88f5420abf002551b47def40c056793e1e25786ce69c721ae874c41f5934efbad13e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
a8b3036d35a7b6e3c02725d429c83ab7

SHA1
7e8f5d736f133b46ee6a7a2ca4ec7fdf4cfea6e2

SHA256
f12bd84fd0a11a7ca4a25dcfd04970bae5a30cb8f7e618621a675bb493973a83

SHA512
f5a90c4c8848bdd85e208713d28223797c9556d25658ffab15091f06da1d79945294f97726dd87a0e3a2e0e1a13043d2960e4826ee455ffc30353f9f92ab17a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
251KB

MD5
94269760355dc29d625fcc20e80a5cef

SHA1
0027c6056c92889304184abc03b91a4ee35dccf0

SHA256
4784db290170a30a9630c8c1c7c632c0bf4b534b3fa575036d4575a26c8c5322

SHA512
4d286d020095cbae7cf4d92f17ee739f98a5970c263c4b57f90e16dd125b1853d9b3d850e2ee1f6ae057147d8dad7eeba6d09cf812f99fa1c350586fdaf68d0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
63d6e2a7f262ba519e14800085d4411f

SHA1
9de9dd2d205e79396a008c3d5d04641a2b4477bf

SHA256
aee35b50d59d67784f8aa29663b1341eed96cb762726ec5b6f2ae832fa778fa4

SHA512
8d0b03db74fc3da0a3cc950c92a7070e5ae69e9174a81f9fdfb629cea07d2246a1284c9a7f84e1ae10d020348fcd2dd9aab237aa4405e869362e20e3c2253a89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
40062cd26dd9f4b84643fe5ccc0127cf

SHA1
4fdc413191ed0400cd27d5453774746a5032327c

SHA256
a3b5f85d4a88b78c16c01814f9c0c082d856fe2c63818f5b67949ed5329e3297

SHA512
9ef4c01923d33510f481cf39b176ea2a7d0d5ffd5244dadae987219f673ff48664aaed1f2061b201e63206c4608f8d6b35d1fa4470f00e7b257222601a51e8e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c920c33b6051507876b93a1e2e00969b

SHA1
c4102fbcdd0037f462833aa381c4ec011a7efb1b

SHA256
cf297484ef95ac1bd3e23e27c4b2162b8d5cfd14ab37b12c43984020c9680805

SHA512
7a8492419d95d890ef5e39580d60eaa14ea39725b4c0230e087cea30cdd86c23d154d77d10ba0159e48d455761bda92a439009b05ded38d4462c7ba694c2a13f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
c66e7c70dd1dacec6be8b9b5d0b9908b

SHA1
e24cde14d8b01bcd2d887e4f792f8f1c404a1e37

SHA256
4fa15bad40c171156613fd8f36a819055e68ebc6f235ece00f77fcb462b68c3f

SHA512
34bdbbcea835a471e15e40fcfcdcee062ec678259a5cd52629cf71cd979f4f73c37c04854a7805712f9fdfde49a934c06e4d9654540e72d2f1456add2d74bcf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
8172a064145cfbf4f4ae9a7ff8ca1d1b

SHA1
adf2867380d48bae9784a4c0fa42cf402498baf2

SHA256
c90115f2f73f0bdfedd787b31f9333936064ec9ff313d75e04bc96419e07e1dc

SHA512
6373741de68e4a689707df357bedd84550f19bf2e0c6c2a1f2400a6babb0d4743c9fda46366ff2cc67ce6d090a618fca59a2f1ea43c42742dbb6197f959a5ce4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c0bb7bc0d3e3be1e5888745dff9a8a94

SHA1
3c6bf60d83735bfbe3aded56de99f6ff88746bb0

SHA256
b309e0746e3224eac7c09008282b5a4f078b087ed60b4045ae6ec93e34805a81

SHA512
eeefcd49fab54107a6d28c1d48e4a09ec039931e646edd94865b49a8c9b9278175d563d62f9cb0a49ca2c6c936774a9ccfa966768dff71bb250788feee3b1fbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ec4d2dbd8c3522cf3051885b2ca949cb

SHA1
d205f5f4f2ceff22f06093673ada758e29125bcb

SHA256
bef7c33a766e8c0c4cdce9b97be41cd91708fb595eeecde6663078e91a2beacc

SHA512
251734cd8a7a8ef41a27ac26c205c8d6012d773ec30e43b76c1352d0142fc1577527b0d71caf398bf2dab78ea1370f0a2e6a9db1423560d492c127a65a156332

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0f87d68f1bc3923dc8c7d9847dfefb8d

SHA1
8f12e2dad920ad66f186dc27ad9e4c7a8fb7dabb

SHA256
e9adb54957c3b5efd8a6d0f58692cc1759123c3d454f9501a50b94f9ea04104b

SHA512
593c984b5c80da3544eb3ca6ac93aac8adf699f1cd208b95efd8ac4b6c4860c5df676a45185f92b3a8040f7e8697f1ef1f9379ede2e81d8eeeddf526fe8fb3e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d8c40b9865eeb65a52098902e8b2a0f5

SHA1
3942bd498a55b4212c25e753198a801848843701

SHA256
0557948c02e2a779dcca4277beec2b7eb690f5b6fbdbe9cad5a02d38d206f3e3

SHA512
8a958e73aa7a06b3e3f16a6d691d2297cce05e0bfef561fc0c8a75d71f1fb39893829723fe308d9134ed3e889bfe2a03cb1d72bf14faf042be564f6145285fcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2a40b01828b86a2841b10892302c2957

SHA1
5f4e08cd1b65b0562449b45f143881a9232f0faf

SHA256
289f7c422ad416a7b7565f45e6cba04b4a4d09f141a144f965bfbb7f4618f706

SHA512
e9ee9d67295e195fe3df52192c97573e2200bca55e3c9547d7c84ba6e50cdb4d20e442bdc19ae5ae2333b794154daccc17778cfe62eac063f9475ec9ac8624a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b27fc088e0ab679ae049b37f8157dded

SHA1
2b32a56e67ca5fd23f425b7ca2c89ded17edfb39

SHA256
9e3d1ee536be751fccc0b77eeb9b3e7e68f44069377d0287725f0b0caaf5b0a0

SHA512
81ad6d8082a45ade9969aa0272a3c09799653689860c1c8f1a0036ed31d47f58db70429d984f35d91d0b0b63af93b86c8f9bc2ee4f9beb62bc53257958b8ac64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4bd09cb2bd28adc69290096ffe9ff3a3

SHA1
5e67426acd9bfc64cb7350bf8e46930ade1fb912

SHA256
54d9d7eebb215df770e4434bae83d6b44b3ef1f136fdd71f555e2236c2559877

SHA512
b0509f8cae07000356511b087c83ea03632913a4f24ea0b18db86611aae099a07b92bb4972ba7258ca4bc86ae7c1629c321892554a3ea8573a069c0a6f610e10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bb36f142f4bd7acf7459803dabe9d54b

SHA1
8f5afd4f689838a2c696fc3f3abe5e5651384f98

SHA256
f0a9eecf736ede8a60dbe4a084cab9f94b5bfba6889d29827a785034936cc161

SHA512
4ba17ed060746934a69cf04b9e3286536786c8c4f2a1b67be63dd86a8a5c48ae4863918f158106a1e4fa096fd0e0de037a68dbdfce71a09665fe67ea90a3f209

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fc91915c1ffe161d8da983b0a105804b

SHA1
bc4daf0bb20a96f000ec970643d5693e79653fac

SHA256
4b6e1576b61b5e0fd65a38f58be91ca364245a07bffe9703eb982cc069d017ca

SHA512
73ce75e648baab75d6053764a93c749cc8aecd4667ad71f2b9c70dbf1df24b516f97558966a65c4acb4b0eb4e65acd1d42b617606cfed549bd75a8fec247abb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d1d7592a4538f381143ce5f410e4f305

SHA1
f4646194f56d6db12dc9d5f683ec58d9154a8694

SHA256
5ec79536d179621a54a5ed4bceea59c773053dbf2680340e7ee7233c6a957956

SHA512
04536c674ca492d2831f696252dcc4a6427df9322dff99a06e14d71cbb50c4de68d03ebbc446beb83d2d299d370c03f9b81420f3528e2a73d2ad2735b70caec9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3e59ae2aad069cc444be35b3ed60761b

SHA1
4cd84174ad7c506bafb1c2fadce1aa737ba62f10

SHA256
1ceb63e4b16056b92e1788a9b8ccd676d15178c4779e3afe578be030e3477043

SHA512
77dd983912a337705da03ad917620b4e6dbc6e7b17ebb0cf858e031fe64121bf6e2d26850759c156b949fbc1b14775e62487b6a28f9e94486c8444e3cb54ab42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3b7b38b6ef053462ec9d14280f12b34

SHA1
681aab8284d90e89be0367869cbbc5384f7b4746

SHA256
1cfba8c0903ae7f581a7fdf55ab21d8b5a511c1dfd4d41f8eb7ade7c217ef677

SHA512
d6210dcb738bcfa57d3e0dbd7063ce9a52b701459bf2e1cd2bd5619b8021c347e4fe14ff3a5996a976bf3be5da81c6bc3a9135234358b62a33f8c2f4827d2bbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
98e51d3f171bc0b273fd65f644c76fb2

SHA1
9106ac492c3d1ab68eb4cb1391f17724ef33dea8

SHA256
0b5c2e6c2fd0d628f3da89de2f48f6180f78d6e6e68d1c4435de37e6c4a73a34

SHA512
7a083205da79a1a93c7875532561a6047fbaa34165ad75e525e5c4bbf8f688641a3fdca6e344d7da94ccf0292de7ac7c6073b8abcadf2d522a735b185f9c5b52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
205KB

MD5
0b45c6c1a5b9e818c34627a849feef58

SHA1
7f5a7c9a58f675135a5bb5433bfea81d3b7e8516

SHA256
5c1cfded2b5f134aec2bd64a3c6b741ad4d715c51b62d41e6977cf8fee3c8a2b

SHA512
be260407b0263bba52b5d52f1c7555114f635a665c40b0ef201cc91603b2c4cfaa0521f162179a6ec416297229771c8e0bc6b06aba723c851f1813b7cbc202f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
205KB

MD5
0932836ae483d2a3757ba0b225010f0e

SHA1
8f06e6b440fa4e4bc1ac93fae79f4943343d8262

SHA256
3cd7dc70ae467277c087be2bf06e688df47357956356601bf6d21070970d4ef1

SHA512
b940042b50c08a90612774c04dd7f446b3cdd6f3dedeb96e4eb386eacd6cc473022d0d31e58946f517080be3396f2e25a01d66956de2fd0bf9771c402a90f377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BootstrapperV1.17.exe.log

Filesize
1KB

MD5
31c453119ec9dc7752421c693ba52edc

SHA1
cb96c8fa3036dabe3846a90c21a71e5578acf059

SHA256
6dcd9446147f57c13b75a331467fb80abcd04a0fc09a4b9ccc076b173228c5c4

SHA512
d43611ed2976300dff71828681ab2e6b85707ea60810c129088023c10c71440decfa8f8cf41e75ab6c03bcc14b334c503d38581aec2eba75b76fb1223f94f0fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\Downloads\BootstrapperV1.17.exe.crdownload

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Users\Admin\Downloads\BootstrapperV1.17.exe:Zone.Identifier

Filesize
229B

MD5
6e0f7b7fc2544253d00aa0a04929d737

SHA1
5539cc78b9b3b02e36013ccc913c3da523753d49

SHA256
dc2a6a546526979fbd0f54dc0563aefb9b25ad06bf03cdbb44f1a651fe95cc03

SHA512
fff993b1c990dd8dc8a75462dcf0767437fe78136fb4a07bda25fb7164ebb26559e0c63f38b4017c925c44cdb6f0098495353e8ae1541ab57397a00c0b5dc19b

Download Submit
C:\Windows\Installer\MSIC2F2.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIC333.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIC9DC.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/3004-4-0x00000220C7EA0000-0x00000220C7EC2000-memory.dmp

Filesize
136KB

Download
memory/3004-2791-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

Filesize
10.8MB

Download
memory/3004-2387-0x00000220C83E0000-0x00000220C83F2000-memory.dmp

Filesize
72KB

Download
memory/3004-2385-0x00000220C83A0000-0x00000220C83AA000-memory.dmp

Filesize
40KB

Download
memory/3004-2-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

Filesize
10.8MB

Download
memory/3004-1-0x00000220AD710000-0x00000220AD7DE000-memory.dmp

Filesize
824KB

Download
memory/3004-5-0x00007FFCBC393000-0x00007FFCBC395000-memory.dmp

Filesize
8KB

Download
memory/3004-0-0x00007FFCBC393000-0x00007FFCBC395000-memory.dmp

Filesize
8KB

Download
memory/3004-6-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

Filesize
10.8MB

Download
memory/3584-2941-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2892-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2888-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2891-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2889-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2944-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2943-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2942-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2890-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

Filesize
64KB

Download
memory/3584-2903-0x00007FFC9A7C0000-0x00007FFC9A7D0000-memory.dmp

Filesize
64KB

Download
memory/3584-2902-0x00007FFC9A7C0000-0x00007FFC9A7D0000-memory.dmp

Filesize
64KB

Download
memory/3716-3185-0x00000211D72E0000-0x00000211D781C000-memory.dmp

Filesize
5.2MB

Download
memory/3716-3207-0x0000000180000000-0x00000001810ED000-memory.dmp

Filesize
16.9MB

Download
memory/3716-3210-0x00000211D7220000-0x00000211D72B0000-memory.dmp

Filesize
576KB

Download
memory/3716-3211-0x00000211D6F00000-0x00000211D6F08000-memory.dmp

Filesize
32KB

Download
memory/3716-3214-0x00000211D6F30000-0x00000211D6F3E000-memory.dmp

Filesize
56KB

Download
memory/3716-3213-0x00000211DADA0000-0x00000211DADD8000-memory.dmp

Filesize
224KB

Download
memory/3716-3206-0x0000000180000000-0x00000001810ED000-memory.dmp

Filesize
16.9MB

Download
memory/3716-3183-0x00000211BC650000-0x00000211BC674000-memory.dmp

Filesize
144KB

Download
memory/3716-3208-0x0000000180000000-0x00000001810ED000-memory.dmp

Filesize
16.9MB

Download
memory/3716-3209-0x00000211BE510000-0x00000211BE520000-memory.dmp

Filesize
64KB

Download
memory/3716-3205-0x0000000180000000-0x00000001810ED000-memory.dmp

Filesize
16.9MB

Download
memory/3716-3188-0x00000211D7010000-0x00000211D70C2000-memory.dmp

Filesize
712KB

Download
memory/3716-3324-0x0000000180000000-0x00000001810ED000-memory.dmp

Filesize
16.9MB

Download
memory/3716-3186-0x00000211D6F50000-0x00000211D700A000-memory.dmp

Filesize
744KB

Download
memory/3924-3371-0x000002BF1CB40000-0x000002BF1CCEC000-memory.dmp

Filesize
1.7MB

Download
memory/4356-3227-0x00007FFCDBF70000-0x00007FFCDBF71000-memory.dmp

Filesize
4KB

Download
memory/4356-3370-0x0000014199140000-0x00000141992EC000-memory.dmp

Filesize
1.7MB

Download