Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/09/2024, 18:01

240901-wmcrtsxfjj 7

01/09/2024, 17:47

240901-wc2yzaxhpa 9

Analysis

  • max time kernel
    242s
  • max time network
    241s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/09/2024, 17:47

General

  • Target

    BootstrapperV1.17.exe

  • Size

    796KB

  • MD5

    4b94b989b0fe7bec6311153b309dfe81

  • SHA1

    bb50a4bb8a66f0105c5b74f32cd114c672010b22

  • SHA256

    7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

  • SHA512

    fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

  • SSDEEP

    12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Blocklisted process makes network request 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 30 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.17.exe
    "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.17.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4448
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 3ABF056B42C56AC4E98C21F5E481D0EE
      2⤵
      • Loads dropped DLL
      PID:932
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D85A0A84F1A1A04D0A8FBB6C8D17A8C0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1372
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 87CF46AC56F9283A180B90475549E2EC E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Windows\SysWOW64\wevtutil.exe
        "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\System32\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4504
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce1acc40,0x7ffcce1acc4c,0x7ffcce1acc58
      2⤵
        PID:2828
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1852 /prefetch:2
        2⤵
          PID:4584
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2128 /prefetch:3
          2⤵
            PID:2164
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2220 /prefetch:8
            2⤵
              PID:124
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:4628
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3336 /prefetch:1
                2⤵
                  PID:1036
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4532 /prefetch:1
                  2⤵
                    PID:1072
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4688 /prefetch:8
                    2⤵
                      PID:4952
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4876,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4784 /prefetch:8
                      2⤵
                        PID:3560
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4944,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4692 /prefetch:8
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3752
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4688,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5060 /prefetch:1
                        2⤵
                          PID:1208
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5004,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5056 /prefetch:1
                          2⤵
                            PID:224
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3156,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3332 /prefetch:1
                            2⤵
                              PID:248
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3304,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3328 /prefetch:1
                              2⤵
                                PID:3044
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4972,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5184 /prefetch:1
                                2⤵
                                  PID:2140
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5384,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5364 /prefetch:1
                                  2⤵
                                    PID:688
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5608,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5604 /prefetch:1
                                    2⤵
                                      PID:1696
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5600,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5788 /prefetch:1
                                      2⤵
                                        PID:1148
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5628,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5904 /prefetch:1
                                        2⤵
                                          PID:1068
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3444,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5376 /prefetch:1
                                          2⤵
                                            PID:3128
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3712,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4352 /prefetch:8
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            PID:1440
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5964,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2664 /prefetch:8
                                            2⤵
                                              PID:1404
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3524,i,12986476307311099682,16638174659282385788,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6024 /prefetch:8
                                              2⤵
                                                PID:1080
                                              • C:\Users\Admin\Downloads\BootstrapperV1.17.exe
                                                "C:\Users\Admin\Downloads\BootstrapperV1.17.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1952
                                                • C:\Program Files\nodejs\node.exe
                                                  "node" -v
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4564
                                                • C:\ProgramData\Solara\Solara.exe
                                                  "C:\ProgramData\Solara\Solara.exe"
                                                  3⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3716
                                                  • C:\Program Files\nodejs\node.exe
                                                    "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" a9ffd64593544d93
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2168
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3716.4008.7358629262741924031
                                                    4⤵
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:2324
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x128,0x12c,0x130,0x104,0x1c0,0x7ffcb6023cb8,0x7ffcb6023cc8,0x7ffcb6023cd8
                                                      5⤵
                                                        PID:3972
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
                                                        5⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        PID:4356
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2216 /prefetch:3
                                                        5⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4588
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2516 /prefetch:8
                                                        5⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        PID:3924
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                                                        5⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        PID:4220
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11515831629126263231,9656459954753922554,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3080 /prefetch:8
                                                        5⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2148
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                1⤵
                                                  PID:2060
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                  1⤵
                                                    PID:2052
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\CompareEnable.xltx"
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3584
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:2044
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:3080

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Config.Msi\e57b921.rbs

                                                        Filesize

                                                        1.0MB

                                                        MD5

                                                        873c82f4a6cb20e3be77c7d204602986

                                                        SHA1

                                                        c387bfcb8e8c62cfb473e691f5dd1de01a44cda5

                                                        SHA256

                                                        6b6cea261d763210370c795bebf3275a0c6cc2b7189f0a1f318492e880c9ca1e

                                                        SHA512

                                                        411fcec535fb5c72557d83be8823aa30d7e4386209523229e5fd925509d5dfb68a712823a574b3a4795d00e26be93d7067d1e9cac51d0f5ad2034abcae5f414f

                                                      • C:\Program Files\nodejs\node_etw_provider.man

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        1d51e18a7247f47245b0751f16119498

                                                        SHA1

                                                        78f5d95dd07c0fcee43c6d4feab12d802d194d95

                                                        SHA256

                                                        1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

                                                        SHA512

                                                        1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

                                                      • C:\Program Files\nodejs\node_etw_provider.man

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        d3bc164e23e694c644e0b1ce3e3f9910

                                                        SHA1

                                                        1849f8b1326111b5d4d93febc2bafb3856e601bb

                                                        SHA256

                                                        1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

                                                        SHA512

                                                        91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

                                                        Filesize

                                                        818B

                                                        MD5

                                                        2916d8b51a5cc0a350d64389bc07aef6

                                                        SHA1

                                                        c9d5ac416c1dd7945651bee712dbed4d158d09e1

                                                        SHA256

                                                        733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                                                        SHA512

                                                        508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        5ad87d95c13094fa67f25442ff521efd

                                                        SHA1

                                                        01f1438a98e1b796e05a74131e6bb9d66c9e8542

                                                        SHA256

                                                        67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                                                        SHA512

                                                        7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

                                                        Filesize

                                                        754B

                                                        MD5

                                                        d2cf52aa43e18fdc87562d4c1303f46a

                                                        SHA1

                                                        58fb4a65fffb438630351e7cafd322579817e5e1

                                                        SHA256

                                                        45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                                                        SHA512

                                                        54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

                                                        Filesize

                                                        771B

                                                        MD5

                                                        e9dc66f98e5f7ff720bf603fff36ebc5

                                                        SHA1

                                                        f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                                                        SHA256

                                                        b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                                                        SHA512

                                                        8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

                                                        Filesize

                                                        730B

                                                        MD5

                                                        072ac9ab0c4667f8f876becedfe10ee0

                                                        SHA1

                                                        0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                                                        SHA256

                                                        2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                                                        SHA512

                                                        f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        d116a360376e31950428ed26eae9ffd4

                                                        SHA1

                                                        192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                                                        SHA256

                                                        c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                                                        SHA512

                                                        5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

                                                        Filesize

                                                        802B

                                                        MD5

                                                        d7c8fab641cd22d2cd30d2999cc77040

                                                        SHA1

                                                        d293601583b1454ad5415260e4378217d569538e

                                                        SHA256

                                                        04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                                                        SHA512

                                                        278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

                                                        Filesize

                                                        16KB

                                                        MD5

                                                        bc0c0eeede037aa152345ab1f9774e92

                                                        SHA1

                                                        56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                                                        SHA256

                                                        7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                                                        SHA512

                                                        5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

                                                        Filesize

                                                        780B

                                                        MD5

                                                        b020de8f88eacc104c21d6e6cacc636d

                                                        SHA1

                                                        20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                                                        SHA256

                                                        3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                                                        SHA512

                                                        4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

                                                        Filesize

                                                        763B

                                                        MD5

                                                        7428aa9f83c500c4a434f8848ee23851

                                                        SHA1

                                                        166b3e1c1b7d7cb7b070108876492529f546219f

                                                        SHA256

                                                        1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                                                        SHA512

                                                        c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        f0bd53316e08991d94586331f9c11d97

                                                        SHA1

                                                        f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

                                                        SHA256

                                                        dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

                                                        SHA512

                                                        fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

                                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

                                                        Filesize

                                                        771B

                                                        MD5

                                                        1d7c74bcd1904d125f6aff37749dc069

                                                        SHA1

                                                        21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

                                                        SHA256

                                                        24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

                                                        SHA512

                                                        b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

                                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

                                                        Filesize

                                                        168B

                                                        MD5

                                                        db7dbbc86e432573e54dedbcc02cb4a1

                                                        SHA1

                                                        cff9cfb98cff2d86b35dc680b405e8036bbbda47

                                                        SHA256

                                                        7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

                                                        SHA512

                                                        8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

                                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

                                                        Filesize

                                                        133B

                                                        MD5

                                                        35b86e177ab52108bd9fed7425a9e34a

                                                        SHA1

                                                        76a1f47a10e3ab829f676838147875d75022c70c

                                                        SHA256

                                                        afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                                                        SHA512

                                                        3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                                                      • C:\ProgramData\Solara\Monaco\fileaccess\index.js

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        0e709bfb5675ff0531c925b909b58008

                                                        SHA1

                                                        25a8634dd21c082d74a7dead157568b6a8fc9825

                                                        SHA256

                                                        ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67

                                                        SHA512

                                                        35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd

                                                      • C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\package.json

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        3b5b76b70b0a549dce72c5a02756d2a8

                                                        SHA1

                                                        07786baebb5c52882e28a8bd281c9a36d63dd116

                                                        SHA256

                                                        bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859

                                                        SHA512

                                                        bb266dfa725421fb26d26fda0f45a5fa5cd832667b05f27ceaf4e7fc1e032aeea8700493cfdd2941c3c38cd166eee1000d2b9ae3ddef375714e25a2027a943a3

                                                      • C:\ProgramData\Solara\Monaco\fileaccess\package.json

                                                        Filesize

                                                        53B

                                                        MD5

                                                        b9f2ca8a50d6d71642dd920c76a851e5

                                                        SHA1

                                                        8ca43e514f808364d0eb51e7a595e309a77fdfce

                                                        SHA256

                                                        f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde

                                                        SHA512

                                                        81b6352bbabd0bffbc50bfcd0cd67dc3c2a7d63bda0bf12421410c0ec8047af549a4928b5c5c3e89ead99aa9240bddb461c618c49287c15d9d4d3a899e8f596a

                                                      • C:\ProgramData\Solara\Newtonsoft.Json.dll

                                                        Filesize

                                                        695KB

                                                        MD5

                                                        195ffb7167db3219b217c4fd439eedd6

                                                        SHA1

                                                        1e76e6099570ede620b76ed47cf8d03a936d49f8

                                                        SHA256

                                                        e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                                        SHA512

                                                        56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                                      • C:\ProgramData\Solara\Solara.exe

                                                        Filesize

                                                        133KB

                                                        MD5

                                                        ddfdd5ff817b39f037284d2f900de407

                                                        SHA1

                                                        8540c39f3c0d133ae7a41581a74183bb887f8363

                                                        SHA256

                                                        3bb95ce8e49260a0ad856feb3bc79fcb0ca94c866c8694c7e302f087e8b712aa

                                                        SHA512

                                                        18bb853a124c336870caece45e115c0865f9ce9e7ce3d6e994e9c8ba9789eaf8d6fc77aa17289531920ea8aef36311fa03405965aba0d5fdf4ec251c5dee778f

                                                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        c75967549639bf2d5a3317dc2d597b4d

                                                        SHA1

                                                        a7ce356d548b787cfaffec398f60fb709c105d58

                                                        SHA256

                                                        2ea74f3d80281811e4bf4907c6861f76f065ac533c411e839e950c6425efae66

                                                        SHA512

                                                        d9ddaca2a432aac7293d1b76fc243f2efd384fbdb3171c8b16569d323e92b0ca8b9725ba1cb8e7065669d2aeea7cecf07c2e5a7779690cf8fb4720ef9c020612

                                                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        763aaa5cf280431292c7ad22447eeb1e

                                                        SHA1

                                                        1b86f2ad4f00149cedddb583447d943ebb1e9828

                                                        SHA256

                                                        73159683846d81f77fa7447f4c8e522100cfe041ee9b52a8858a178e48614839

                                                        SHA512

                                                        b36b92e4a17a2564b37fac5022b059ab1336b08c7abaea0dd026680c6269951df966a19568769ef81051567d39d407e9a122727f1a9c1d5da0400dc6605536f1

                                                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

                                                        Filesize

                                                        41B

                                                        MD5

                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                        SHA1

                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                        SHA256

                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                        SHA512

                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                      • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                      • C:\ProgramData\Solara\SolaraV3.dll

                                                        Filesize

                                                        6.5MB

                                                        MD5

                                                        1462d874e5ff71903a531fab6bd4dead

                                                        SHA1

                                                        57ea11418a14005d5dc756517ade5791e785a86d

                                                        SHA256

                                                        35d5849f6af8ec79cbff70b4de6bcf86d9a5a6733bcbbaa382d87555c36ff1bb

                                                        SHA512

                                                        4169a607dfd37c268b028860bae184d360790996fe26ecde33e8d94fa3ee08bc0ff1b246f5dc0328e279e3279a0721c9d6373f0953038aa5ff1adb6d7cdc14ea

                                                      • C:\ProgramData\Solara\Wpf.Ui.dll

                                                        Filesize

                                                        5.2MB

                                                        MD5

                                                        aead90ab96e2853f59be27c4ec1e4853

                                                        SHA1

                                                        43cdedde26488d3209e17efff9a51e1f944eb35f

                                                        SHA256

                                                        46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                                        SHA512

                                                        f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                                                      • C:\ProgramData\Solara\bin\version.txt

                                                        Filesize

                                                        5B

                                                        MD5

                                                        4e1aa466b3d6af47b4474ab22282d6f5

                                                        SHA1

                                                        4c967902d76815d00d9524411bd44c1f02417c10

                                                        SHA256

                                                        277714254c43ea9071d68ce359fee319fca802b6d6cc98f37f2fe8697a7e1b61

                                                        SHA512

                                                        ea5b23f04484d896fbd698ce3ac3a7b79f5ab4f661851ee7334213b83cac4b05fb32204b4238b9a41a571ed5de08b70c726c04ba3c00381fdbf852ad5e6ee1e0

                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                        Filesize

                                                        64KB

                                                        MD5

                                                        b5ad5caaaee00cb8cf445427975ae66c

                                                        SHA1

                                                        dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                        SHA256

                                                        b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                        SHA512

                                                        92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                        Filesize

                                                        4B

                                                        MD5

                                                        f49655f856acb8884cc0ace29216f511

                                                        SHA1

                                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                        SHA256

                                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                        SHA512

                                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                        Filesize

                                                        1008B

                                                        MD5

                                                        d222b77a61527f2c177b0869e7babc24

                                                        SHA1

                                                        3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                        SHA256

                                                        80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                        SHA512

                                                        d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b2ce21e-f92e-419d-84ee-997945a5a168.tmp

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        19e624c81778c234e63549de4a6c7726

                                                        SHA1

                                                        3316a22dadd8ce9b2c8c045000549a33da255113

                                                        SHA256

                                                        492b81462aed4875c25103171f3f6208e986a26afab2ba1bc1c100d1c8cc803a

                                                        SHA512

                                                        1e4bff8680f847c3d725cb7a25a356ebc5b726373a0d1f97cba0a30e02f88f5420abf002551b47def40c056793e1e25786ce69c721ae874c41f5934efbad13e2

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                        Filesize

                                                        649B

                                                        MD5

                                                        a8b3036d35a7b6e3c02725d429c83ab7

                                                        SHA1

                                                        7e8f5d736f133b46ee6a7a2ca4ec7fdf4cfea6e2

                                                        SHA256

                                                        f12bd84fd0a11a7ca4a25dcfd04970bae5a30cb8f7e618621a675bb493973a83

                                                        SHA512

                                                        f5a90c4c8848bdd85e208713d28223797c9556d25658ffab15091f06da1d79945294f97726dd87a0e3a2e0e1a13043d2960e4826ee455ffc30353f9f92ab17a9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

                                                        Filesize

                                                        251KB

                                                        MD5

                                                        94269760355dc29d625fcc20e80a5cef

                                                        SHA1

                                                        0027c6056c92889304184abc03b91a4ee35dccf0

                                                        SHA256

                                                        4784db290170a30a9630c8c1c7c632c0bf4b534b3fa575036d4575a26c8c5322

                                                        SHA512

                                                        4d286d020095cbae7cf4d92f17ee739f98a5970c263c4b57f90e16dd125b1853d9b3d850e2ee1f6ae057147d8dad7eeba6d09cf812f99fa1c350586fdaf68d0a

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        63d6e2a7f262ba519e14800085d4411f

                                                        SHA1

                                                        9de9dd2d205e79396a008c3d5d04641a2b4477bf

                                                        SHA256

                                                        aee35b50d59d67784f8aa29663b1341eed96cb762726ec5b6f2ae832fa778fa4

                                                        SHA512

                                                        8d0b03db74fc3da0a3cc950c92a7070e5ae69e9174a81f9fdfb629cea07d2246a1284c9a7f84e1ae10d020348fcd2dd9aab237aa4405e869362e20e3c2253a89

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        40062cd26dd9f4b84643fe5ccc0127cf

                                                        SHA1

                                                        4fdc413191ed0400cd27d5453774746a5032327c

                                                        SHA256

                                                        a3b5f85d4a88b78c16c01814f9c0c082d856fe2c63818f5b67949ed5329e3297

                                                        SHA512

                                                        9ef4c01923d33510f481cf39b176ea2a7d0d5ffd5244dadae987219f673ff48664aaed1f2061b201e63206c4608f8d6b35d1fa4470f00e7b257222601a51e8e9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        c920c33b6051507876b93a1e2e00969b

                                                        SHA1

                                                        c4102fbcdd0037f462833aa381c4ec011a7efb1b

                                                        SHA256

                                                        cf297484ef95ac1bd3e23e27c4b2162b8d5cfd14ab37b12c43984020c9680805

                                                        SHA512

                                                        7a8492419d95d890ef5e39580d60eaa14ea39725b4c0230e087cea30cdd86c23d154d77d10ba0159e48d455761bda92a439009b05ded38d4462c7ba694c2a13f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        356B

                                                        MD5

                                                        c66e7c70dd1dacec6be8b9b5d0b9908b

                                                        SHA1

                                                        e24cde14d8b01bcd2d887e4f792f8f1c404a1e37

                                                        SHA256

                                                        4fa15bad40c171156613fd8f36a819055e68ebc6f235ece00f77fcb462b68c3f

                                                        SHA512

                                                        34bdbbcea835a471e15e40fcfcdcee062ec678259a5cd52629cf71cd979f4f73c37c04854a7805712f9fdfde49a934c06e4d9654540e72d2f1456add2d74bcf3

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        8172a064145cfbf4f4ae9a7ff8ca1d1b

                                                        SHA1

                                                        adf2867380d48bae9784a4c0fa42cf402498baf2

                                                        SHA256

                                                        c90115f2f73f0bdfedd787b31f9333936064ec9ff313d75e04bc96419e07e1dc

                                                        SHA512

                                                        6373741de68e4a689707df357bedd84550f19bf2e0c6c2a1f2400a6babb0d4743c9fda46366ff2cc67ce6d090a618fca59a2f1ea43c42742dbb6197f959a5ce4

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        c0bb7bc0d3e3be1e5888745dff9a8a94

                                                        SHA1

                                                        3c6bf60d83735bfbe3aded56de99f6ff88746bb0

                                                        SHA256

                                                        b309e0746e3224eac7c09008282b5a4f078b087ed60b4045ae6ec93e34805a81

                                                        SHA512

                                                        eeefcd49fab54107a6d28c1d48e4a09ec039931e646edd94865b49a8c9b9278175d563d62f9cb0a49ca2c6c936774a9ccfa966768dff71bb250788feee3b1fbd

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        ec4d2dbd8c3522cf3051885b2ca949cb

                                                        SHA1

                                                        d205f5f4f2ceff22f06093673ada758e29125bcb

                                                        SHA256

                                                        bef7c33a766e8c0c4cdce9b97be41cd91708fb595eeecde6663078e91a2beacc

                                                        SHA512

                                                        251734cd8a7a8ef41a27ac26c205c8d6012d773ec30e43b76c1352d0142fc1577527b0d71caf398bf2dab78ea1370f0a2e6a9db1423560d492c127a65a156332

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        0f87d68f1bc3923dc8c7d9847dfefb8d

                                                        SHA1

                                                        8f12e2dad920ad66f186dc27ad9e4c7a8fb7dabb

                                                        SHA256

                                                        e9adb54957c3b5efd8a6d0f58692cc1759123c3d454f9501a50b94f9ea04104b

                                                        SHA512

                                                        593c984b5c80da3544eb3ca6ac93aac8adf699f1cd208b95efd8ac4b6c4860c5df676a45185f92b3a8040f7e8697f1ef1f9379ede2e81d8eeeddf526fe8fb3e5

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        d8c40b9865eeb65a52098902e8b2a0f5

                                                        SHA1

                                                        3942bd498a55b4212c25e753198a801848843701

                                                        SHA256

                                                        0557948c02e2a779dcca4277beec2b7eb690f5b6fbdbe9cad5a02d38d206f3e3

                                                        SHA512

                                                        8a958e73aa7a06b3e3f16a6d691d2297cce05e0bfef561fc0c8a75d71f1fb39893829723fe308d9134ed3e889bfe2a03cb1d72bf14faf042be564f6145285fcf

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        2a40b01828b86a2841b10892302c2957

                                                        SHA1

                                                        5f4e08cd1b65b0562449b45f143881a9232f0faf

                                                        SHA256

                                                        289f7c422ad416a7b7565f45e6cba04b4a4d09f141a144f965bfbb7f4618f706

                                                        SHA512

                                                        e9ee9d67295e195fe3df52192c97573e2200bca55e3c9547d7c84ba6e50cdb4d20e442bdc19ae5ae2333b794154daccc17778cfe62eac063f9475ec9ac8624a3

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        b27fc088e0ab679ae049b37f8157dded

                                                        SHA1

                                                        2b32a56e67ca5fd23f425b7ca2c89ded17edfb39

                                                        SHA256

                                                        9e3d1ee536be751fccc0b77eeb9b3e7e68f44069377d0287725f0b0caaf5b0a0

                                                        SHA512

                                                        81ad6d8082a45ade9969aa0272a3c09799653689860c1c8f1a0036ed31d47f58db70429d984f35d91d0b0b63af93b86c8f9bc2ee4f9beb62bc53257958b8ac64

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        4bd09cb2bd28adc69290096ffe9ff3a3

                                                        SHA1

                                                        5e67426acd9bfc64cb7350bf8e46930ade1fb912

                                                        SHA256

                                                        54d9d7eebb215df770e4434bae83d6b44b3ef1f136fdd71f555e2236c2559877

                                                        SHA512

                                                        b0509f8cae07000356511b087c83ea03632913a4f24ea0b18db86611aae099a07b92bb4972ba7258ca4bc86ae7c1629c321892554a3ea8573a069c0a6f610e10

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        bb36f142f4bd7acf7459803dabe9d54b

                                                        SHA1

                                                        8f5afd4f689838a2c696fc3f3abe5e5651384f98

                                                        SHA256

                                                        f0a9eecf736ede8a60dbe4a084cab9f94b5bfba6889d29827a785034936cc161

                                                        SHA512

                                                        4ba17ed060746934a69cf04b9e3286536786c8c4f2a1b67be63dd86a8a5c48ae4863918f158106a1e4fa096fd0e0de037a68dbdfce71a09665fe67ea90a3f209

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        fc91915c1ffe161d8da983b0a105804b

                                                        SHA1

                                                        bc4daf0bb20a96f000ec970643d5693e79653fac

                                                        SHA256

                                                        4b6e1576b61b5e0fd65a38f58be91ca364245a07bffe9703eb982cc069d017ca

                                                        SHA512

                                                        73ce75e648baab75d6053764a93c749cc8aecd4667ad71f2b9c70dbf1df24b516f97558966a65c4acb4b0eb4e65acd1d42b617606cfed549bd75a8fec247abb9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        d1d7592a4538f381143ce5f410e4f305

                                                        SHA1

                                                        f4646194f56d6db12dc9d5f683ec58d9154a8694

                                                        SHA256

                                                        5ec79536d179621a54a5ed4bceea59c773053dbf2680340e7ee7233c6a957956

                                                        SHA512

                                                        04536c674ca492d2831f696252dcc4a6427df9322dff99a06e14d71cbb50c4de68d03ebbc446beb83d2d299d370c03f9b81420f3528e2a73d2ad2735b70caec9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        3e59ae2aad069cc444be35b3ed60761b

                                                        SHA1

                                                        4cd84174ad7c506bafb1c2fadce1aa737ba62f10

                                                        SHA256

                                                        1ceb63e4b16056b92e1788a9b8ccd676d15178c4779e3afe578be030e3477043

                                                        SHA512

                                                        77dd983912a337705da03ad917620b4e6dbc6e7b17ebb0cf858e031fe64121bf6e2d26850759c156b949fbc1b14775e62487b6a28f9e94486c8444e3cb54ab42

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        e3b7b38b6ef053462ec9d14280f12b34

                                                        SHA1

                                                        681aab8284d90e89be0367869cbbc5384f7b4746

                                                        SHA256

                                                        1cfba8c0903ae7f581a7fdf55ab21d8b5a511c1dfd4d41f8eb7ade7c217ef677

                                                        SHA512

                                                        d6210dcb738bcfa57d3e0dbd7063ce9a52b701459bf2e1cd2bd5619b8021c347e4fe14ff3a5996a976bf3be5da81c6bc3a9135234358b62a33f8c2f4827d2bbb

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                        Filesize

                                                        15KB

                                                        MD5

                                                        98e51d3f171bc0b273fd65f644c76fb2

                                                        SHA1

                                                        9106ac492c3d1ab68eb4cb1391f17724ef33dea8

                                                        SHA256

                                                        0b5c2e6c2fd0d628f3da89de2f48f6180f78d6e6e68d1c4435de37e6c4a73a34

                                                        SHA512

                                                        7a083205da79a1a93c7875532561a6047fbaa34165ad75e525e5c4bbf8f688641a3fdca6e344d7da94ccf0292de7ac7c6073b8abcadf2d522a735b185f9c5b52

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        205KB

                                                        MD5

                                                        0b45c6c1a5b9e818c34627a849feef58

                                                        SHA1

                                                        7f5a7c9a58f675135a5bb5433bfea81d3b7e8516

                                                        SHA256

                                                        5c1cfded2b5f134aec2bd64a3c6b741ad4d715c51b62d41e6977cf8fee3c8a2b

                                                        SHA512

                                                        be260407b0263bba52b5d52f1c7555114f635a665c40b0ef201cc91603b2c4cfaa0521f162179a6ec416297229771c8e0bc6b06aba723c851f1813b7cbc202f1

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        205KB

                                                        MD5

                                                        0932836ae483d2a3757ba0b225010f0e

                                                        SHA1

                                                        8f06e6b440fa4e4bc1ac93fae79f4943343d8262

                                                        SHA256

                                                        3cd7dc70ae467277c087be2bf06e688df47357956356601bf6d21070970d4ef1

                                                        SHA512

                                                        b940042b50c08a90612774c04dd7f446b3cdd6f3dedeb96e4eb386eacd6cc473022d0d31e58946f517080be3396f2e25a01d66956de2fd0bf9771c402a90f377

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BootstrapperV1.17.exe.log

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        31c453119ec9dc7752421c693ba52edc

                                                        SHA1

                                                        cb96c8fa3036dabe3846a90c21a71e5578acf059

                                                        SHA256

                                                        6dcd9446147f57c13b75a331467fb80abcd04a0fc09a4b9ccc076b173228c5c4

                                                        SHA512

                                                        d43611ed2976300dff71828681ab2e6b85707ea60810c129088023c10c71440decfa8f8cf41e75ab6c03bcc14b334c503d38581aec2eba75b76fb1223f94f0fd

                                                      • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

                                                        Filesize

                                                        30.1MB

                                                        MD5

                                                        0e4e9aa41d24221b29b19ba96c1a64d0

                                                        SHA1

                                                        231ade3d5a586c0eb4441c8dbfe9007dc26b2872

                                                        SHA256

                                                        5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

                                                        SHA512

                                                        e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

                                                      • C:\Users\Admin\Downloads\BootstrapperV1.17.exe.crdownload

                                                        Filesize

                                                        796KB

                                                        MD5

                                                        4b94b989b0fe7bec6311153b309dfe81

                                                        SHA1

                                                        bb50a4bb8a66f0105c5b74f32cd114c672010b22

                                                        SHA256

                                                        7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

                                                        SHA512

                                                        fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

                                                      • C:\Users\Admin\Downloads\BootstrapperV1.17.exe:Zone.Identifier

                                                        Filesize

                                                        229B

                                                        MD5

                                                        6e0f7b7fc2544253d00aa0a04929d737

                                                        SHA1

                                                        5539cc78b9b3b02e36013ccc913c3da523753d49

                                                        SHA256

                                                        dc2a6a546526979fbd0f54dc0563aefb9b25ad06bf03cdbb44f1a651fe95cc03

                                                        SHA512

                                                        fff993b1c990dd8dc8a75462dcf0767437fe78136fb4a07bda25fb7164ebb26559e0c63f38b4017c925c44cdb6f0098495353e8ae1541ab57397a00c0b5dc19b

                                                      • C:\Windows\Installer\MSIC2F2.tmp

                                                        Filesize

                                                        122KB

                                                        MD5

                                                        9fe9b0ecaea0324ad99036a91db03ebb

                                                        SHA1

                                                        144068c64ec06fc08eadfcca0a014a44b95bb908

                                                        SHA256

                                                        e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

                                                        SHA512

                                                        906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

                                                      • C:\Windows\Installer\MSIC333.tmp

                                                        Filesize

                                                        211KB

                                                        MD5

                                                        a3ae5d86ecf38db9427359ea37a5f646

                                                        SHA1

                                                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                        SHA256

                                                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                        SHA512

                                                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                      • C:\Windows\Installer\MSIC9DC.tmp

                                                        Filesize

                                                        297KB

                                                        MD5

                                                        7a86ce1a899262dd3c1df656bff3fb2c

                                                        SHA1

                                                        33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

                                                        SHA256

                                                        b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

                                                        SHA512

                                                        421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

                                                      • memory/3004-4-0x00000220C7EA0000-0x00000220C7EC2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/3004-2791-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                      • memory/3004-2387-0x00000220C83E0000-0x00000220C83F2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/3004-2385-0x00000220C83A0000-0x00000220C83AA000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/3004-2-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                      • memory/3004-1-0x00000220AD710000-0x00000220AD7DE000-memory.dmp

                                                        Filesize

                                                        824KB

                                                      • memory/3004-5-0x00007FFCBC393000-0x00007FFCBC395000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/3004-0-0x00007FFCBC393000-0x00007FFCBC395000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/3004-6-0x00007FFCBC390000-0x00007FFCBCE52000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                      • memory/3584-2941-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2892-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2888-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2891-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2889-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2944-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2943-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2942-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2890-0x00007FFC9D270000-0x00007FFC9D280000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2903-0x00007FFC9A7C0000-0x00007FFC9A7D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3584-2902-0x00007FFC9A7C0000-0x00007FFC9A7D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3716-3185-0x00000211D72E0000-0x00000211D781C000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                      • memory/3716-3207-0x0000000180000000-0x00000001810ED000-memory.dmp

                                                        Filesize

                                                        16.9MB

                                                      • memory/3716-3210-0x00000211D7220000-0x00000211D72B0000-memory.dmp

                                                        Filesize

                                                        576KB

                                                      • memory/3716-3211-0x00000211D6F00000-0x00000211D6F08000-memory.dmp

                                                        Filesize

                                                        32KB

                                                      • memory/3716-3214-0x00000211D6F30000-0x00000211D6F3E000-memory.dmp

                                                        Filesize

                                                        56KB

                                                      • memory/3716-3213-0x00000211DADA0000-0x00000211DADD8000-memory.dmp

                                                        Filesize

                                                        224KB

                                                      • memory/3716-3206-0x0000000180000000-0x00000001810ED000-memory.dmp

                                                        Filesize

                                                        16.9MB

                                                      • memory/3716-3183-0x00000211BC650000-0x00000211BC674000-memory.dmp

                                                        Filesize

                                                        144KB

                                                      • memory/3716-3208-0x0000000180000000-0x00000001810ED000-memory.dmp

                                                        Filesize

                                                        16.9MB

                                                      • memory/3716-3209-0x00000211BE510000-0x00000211BE520000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3716-3205-0x0000000180000000-0x00000001810ED000-memory.dmp

                                                        Filesize

                                                        16.9MB

                                                      • memory/3716-3188-0x00000211D7010000-0x00000211D70C2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                      • memory/3716-3324-0x0000000180000000-0x00000001810ED000-memory.dmp

                                                        Filesize

                                                        16.9MB

                                                      • memory/3716-3186-0x00000211D6F50000-0x00000211D700A000-memory.dmp

                                                        Filesize

                                                        744KB

                                                      • memory/3924-3371-0x000002BF1CB40000-0x000002BF1CCEC000-memory.dmp

                                                        Filesize

                                                        1.7MB

                                                      • memory/4356-3227-0x00007FFCDBF70000-0x00007FFCDBF71000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/4356-3370-0x0000014199140000-0x00000141992EC000-memory.dmp

                                                        Filesize

                                                        1.7MB