8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
133s
max time network
137s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
29-12-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	BootstrapperV2.08.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 2 IoCs

pid	Process
4228	BootstrapperV2.08.exe
5492	Solara.exe

Loads dropped DLL 6 IoCs

pid	Process
5268	MsiExec.exe
5268	MsiExec.exe
5268	MsiExec.exe
5268	MsiExec.exe
5584	MsiExec.exe
5824	MsiExec.exe

Unexpected DNS network traffic destination 22 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 1 IoCs

flow	pid	Process
82	980	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
29	discord.com
31	discord.com
91	pastebin.com
92	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\asn1\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\lib\options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\cp\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\memoization.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\readdir-or-error.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\build\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\read-entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\node_modules\isexe\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\provenance.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\lib\with-temp-dir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\publish.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-expression-parse\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarnpkg.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npx.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\help-search.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\reify.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\chownr\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\header.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-cache.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\clone.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\run-script.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\dsse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\cjs\src\mkdirp-native.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\analyzer.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-explore.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\v4\constants.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\retry-busy.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-whoami.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\exponential-backoff\dist\delay\skip-first\skip-first.delay.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\rimraf-native.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\translations\en-short.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\@npmcli\fs\lib\cp\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\strip-ansi\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\npm.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\updater.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\unique-filename\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-access.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsbn\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\data\win\large-pdb-shim.cc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\constructors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\exponential-backoff\dist\jitter\no\no.jitter.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\cjs\src\mkdirp-native.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\name-from-folder\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\es2015\RGI_Emoji.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\commonjs\get-write-flag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\dist\esm\package.json	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57d755.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC66.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCB5.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{780AD60E-7FB7-4A4D-9EEC-9C3E72148B95}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e57d759.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE524.tmp	msiexec.exe
File created	C:\Windows\Installer\{780AD60E-7FB7-4A4D-9EEC-9C3E72148B95}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d755.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{780AD60E-7FB7-4A4D-9EEC-9C3E72148B95}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI131C.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1680	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\corepack	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\PackageCode = "0120A6FC5971D8146A4C60F9F9CC1DB7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Version = "369885184"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226857575-536881564-1522996248-1000\{755ACA8A-F8D5-4CFE-8DA4-2D386126C06C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\PackageName = "node-v22.12.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\ProductIcon = "C:\\Windows\\Installer\\{780AD60E-7FB7-4A4D-9EEC-9C3E72148B95}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPath	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1744	WMIC.exe
1744	WMIC.exe
1744	WMIC.exe
1744	WMIC.exe
3296	msedge.exe
3296	msedge.exe
1872	msedge.exe
1872	msedge.exe
2000	msedge.exe
2000	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe
980	msiexec.exe
980	msiexec.exe
5492	Solara.exe
5492	Solara.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1744	WMIC.exe
Token: SeSecurityPrivilege	1744	WMIC.exe
Token: SeTakeOwnershipPrivilege	1744	WMIC.exe
Token: SeLoadDriverPrivilege	1744	WMIC.exe
Token: SeSystemProfilePrivilege	1744	WMIC.exe
Token: SeSystemtimePrivilege	1744	WMIC.exe
Token: SeProfSingleProcessPrivilege	1744	WMIC.exe
Token: SeIncBasePriorityPrivilege	1744	WMIC.exe
Token: SeCreatePagefilePrivilege	1744	WMIC.exe
Token: SeBackupPrivilege	1744	WMIC.exe
Token: SeRestorePrivilege	1744	WMIC.exe
Token: SeShutdownPrivilege	1744	WMIC.exe
Token: SeDebugPrivilege	1744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1744	WMIC.exe
Token: SeRemoteShutdownPrivilege	1744	WMIC.exe
Token: SeUndockPrivilege	1744	WMIC.exe
Token: SeManageVolumePrivilege	1744	WMIC.exe
Token: 33	1744	WMIC.exe
Token: 34	1744	WMIC.exe
Token: 35	1744	WMIC.exe
Token: 36	1744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1744	WMIC.exe
Token: SeSecurityPrivilege	1744	WMIC.exe
Token: SeTakeOwnershipPrivilege	1744	WMIC.exe
Token: SeLoadDriverPrivilege	1744	WMIC.exe
Token: SeSystemProfilePrivilege	1744	WMIC.exe
Token: SeSystemtimePrivilege	1744	WMIC.exe
Token: SeProfSingleProcessPrivilege	1744	WMIC.exe
Token: SeIncBasePriorityPrivilege	1744	WMIC.exe
Token: SeCreatePagefilePrivilege	1744	WMIC.exe
Token: SeBackupPrivilege	1744	WMIC.exe
Token: SeRestorePrivilege	1744	WMIC.exe
Token: SeShutdownPrivilege	1744	WMIC.exe
Token: SeDebugPrivilege	1744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1744	WMIC.exe
Token: SeRemoteShutdownPrivilege	1744	WMIC.exe
Token: SeUndockPrivilege	1744	WMIC.exe
Token: SeManageVolumePrivilege	1744	WMIC.exe
Token: 33	1744	WMIC.exe
Token: 34	1744	WMIC.exe
Token: 35	1744	WMIC.exe
Token: 36	1744	WMIC.exe
Token: SeDebugPrivilege	1268	Bootstrapper.exe
Token: SeDebugPrivilege	4228	BootstrapperV2.08.exe
Token: SeShutdownPrivilege	4592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4592	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	4592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4592	msiexec.exe
Token: SeLockMemoryPrivilege	4592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4592	msiexec.exe
Token: SeMachineAccountPrivilege	4592	msiexec.exe
Token: SeTcbPrivilege	4592	msiexec.exe
Token: SeSecurityPrivilege	4592	msiexec.exe
Token: SeTakeOwnershipPrivilege	4592	msiexec.exe
Token: SeLoadDriverPrivilege	4592	msiexec.exe
Token: SeSystemProfilePrivilege	4592	msiexec.exe
Token: SeSystemtimePrivilege	4592	msiexec.exe
Token: SeProfSingleProcessPrivilege	4592	msiexec.exe
Token: SeIncBasePriorityPrivilege	4592	msiexec.exe
Token: SeCreatePagefilePrivilege	4592	msiexec.exe
Token: SeCreatePermanentPrivilege	4592	msiexec.exe
Token: SeBackupPrivilege	4592	msiexec.exe
Token: SeRestorePrivilege	4592	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1268	Bootstrapper.exe
1872	msedge.exe
1872	msedge.exe
4228	BootstrapperV2.08.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4724	1268	Bootstrapper.exe	82
PID 1268 wrote to memory of 4724	1268	Bootstrapper.exe	82
PID 4724 wrote to memory of 1680	4724	cmd.exe	84
PID 4724 wrote to memory of 1680	4724	cmd.exe	84
PID 1268 wrote to memory of 828	1268	Bootstrapper.exe	90
PID 1268 wrote to memory of 828	1268	Bootstrapper.exe	90
PID 828 wrote to memory of 1744	828	cmd.exe	92
PID 828 wrote to memory of 1744	828	cmd.exe	92
PID 1268 wrote to memory of 4228	1268	Bootstrapper.exe	95
PID 1268 wrote to memory of 4228	1268	Bootstrapper.exe	95
PID 4228 wrote to memory of 1872	4228	BootstrapperV2.08.exe	97
PID 4228 wrote to memory of 1872	4228	BootstrapperV2.08.exe	97
PID 1872 wrote to memory of 1372	1872	msedge.exe	98
PID 1872 wrote to memory of 1372	1872	msedge.exe	98
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 4928	1872	msedge.exe	99
PID 1872 wrote to memory of 3296	1872	msedge.exe	100
PID 1872 wrote to memory of 3296	1872	msedge.exe	100
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101
PID 1872 wrote to memory of 4596	1872	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1680
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/8PgspRYAQu
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ff86a0f46f8,0x7ff86a0f4708,0x7ff86a0f4718
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3884 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:3364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff71b015460,0x7ff71b015470,0x7ff71b015480
        5⤵
        
        PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6127191457840810002,12211867793304212487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4404 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C node -v
    3⤵
    PID:2168
- - C:\Windows\SYSTEM32\msiexec.exe
    "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v22.12.0-x64.msi" /quiet /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B0C86219BFAA12F60F83BAB07291E059
  2⤵
  - Loads dropped DLL
  PID:5268
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DF566F719DBE1C76ABCE30E59377A2C4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:5584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 681026E9A3E3F0BC85AB6CAF483207E1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d758.rbs

Filesize
935KB

MD5
85bba8ac718ab58c62891f7a55afabbe

SHA1
b6d74b270394227f40b94fb347d5efeffef90382

SHA256
7f2f300d06781b5bd464142edf5a5a92873004fa64cbeeaf431214a439b58e63

SHA512
4d6142cbf1f72983bb6179b60044e11ff4cf6a5af637711569184b0dd96fd9114c71d09e70665768c8326122bb5a6c5f9cc776f8f6f0cf7dee5cf5d1a6ae9074

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE

Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js

Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license

Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json

Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json

Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE

Filesize
757B

MD5
8bb6f78000746d4fa0baf4bdbf9e814e

SHA1
4b7049331119a63009aec376677b97c688266613

SHA256
a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

SHA512
ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
d6379e007090480d77959aec07b6417e

SHA1
98eecef8fe63445674124fd32598555c70824080

SHA256
4ca85bbe1d76aa3ac41fd9c939ed731dbee8db9ead4e48d42c0350a0e843ee1f

SHA512
e0f5d61dbbc96801ecfcec709a44c6a231b3358266688be684b883e9114c32301783796a2df26f4cc81a420bd36f365bddc0df7cdc27011b85c21a1a32e10d0a

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23fa82e121d8f73e1416906076e9a963

SHA1
b4666301311a7ccaabbad363cd1dec06f8541da4

SHA256
5fd39927e65645635ebd716dd0aef59e64aacd4b9a6c896328b5b23b6c75159e

SHA512
64920d7d818031469edff5619c00a06e5a2320bc08b3a8a6cd288c75d2a470f8c188c694046d149fa622cbb40b1f8bf572ac3d6dfc59b62a4638341ccb467dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b19b7ecb6ee133c2ff01f7888eae612

SHA1
a592cab7e180cc5c9ac7f4098a3c8c35b89f8253

SHA256
972bc0df18e9a9438dbc5763e29916a24b7e4f15415641230c900b6281515e78

SHA512
16301409fee3a129612cfe7bdb96b010d3da39124aa88b2d111f18d5ae5d4fc8c3c663809148dd07c7f3cd37bb78bd71e25be1584bd2d0bacf529fa7f3461fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
3cff1cce5931887d31239c91d20a39b5

SHA1
af96300d2c3ed6f17071412b4ca41991fc55f0fa

SHA256
54d469bbd81225a43b3434d0961aa31c04be0e9914f29a9948545cc2e0789073

SHA512
91dfe6ea18705540530edc98dcfd9f718f01ce0faf798c16b5ea9824722f168c32c2acb85e757e430f6730328dd8fe7724fcb6fb11637ed23773dcb3675f0363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e704.TMP

Filesize
48B

MD5
ff38b9beee4c1274397cb6923ae6dd42

SHA1
630f0f7c014d78b1c37a3f50fbf2bc48e0f7b957

SHA256
892796a3a6c52ace674562ab8e58df1f2728d5988a50aefc20f5ef5379edad4c

SHA512
aaa92e400c843a661169075577b21838c19bcce61a379c12e6b075c01f0394113b750a5999bdb06f6f34e58e1a29e002b0339b6d9abf512a4b0c4f67860fb3b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
ff9f825925f89085b6c4809612c14b39

SHA1
3cd291d4b9d7bfff93177f074aa75d7034ce0d4e

SHA256
118d159f05b7fb0b7424c2374470d9e77857047f4a0663e944e2363ecf04b0fa

SHA512
735ec4fd0c01534dd09a61b341ed00a0bbb7488c1e267d736041d96e0f6a62c8b4090ded41986464cf82b472831c6d10f9fbf688e20340f6c293ba5332e05d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b11b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5f30ece741694336856266e9a0d3344

SHA1
5dcca9644c20929b240623d939c3e13d5d605724

SHA256
b984e39e400117390d044fd3ace92f4831a65d80866294734323eb2d1cd92d2b

SHA512
7ba82358c2ab46c7c7064ea98ba0eb035edf3e1995e5e733317de9239a7ce1adde3fb23c58b7168731d67de5b54f2d6c3ce9a3ee4f9e1c74c502864e5e525a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d445b2e75172b12465af39ca13dd1c3f

SHA1
2bff9f28b71098108f56793beed650af88357cdd

SHA256
892d26954bfa2c8a8a6b15adfc3c493a41a03a4630816708c7840fc442e48ede

SHA512
153af7b8ad2d0500fac9768fe1c27e3bfa8bde4b843848edf6b32cfdd5156ca8bd576a70938b7ae583dc96e5b1225dbd78d8a0595056c4c838e3d548c19abe5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a70262a3d09dc7c94ced2abfcce45e17

SHA1
9e58639516f9b81883fc83e0d4eac2cf14439544

SHA256
943ef3385d4a5ed103964fb2f763b746a7d32aad9febcc61f97c62dc465ef958

SHA512
1d83b6f7e9279468e09dd54bf10e7959971fb1e8c6b9cc9cacad1db37c7fa31cc39cdfcbf0fc89018d1d90bf0fc669f719e53c35f114ed06b7bd6f98256851bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a209bfde9da9439c95b748b5c17fc7b

SHA1
c37e2fbbee6c135b61e09665abff3b77a62d4788

SHA256
aa0a758fc36190e5243d4b5329c59546a50e17b36173434a7bb24fbd0117dc11

SHA512
bb974f3f245614d043076e6af7d486db721cf7f2134f4fa4384142cee6592986d9523e5190ee192d4f5502229fc357a13d8f054eb813905e4abbce9c64f29546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e02def0d346670ad6b954dc0d31ce710

SHA1
7ac972a4f00348dba552271e2adc96bee1204e74

SHA256
dce2e2e721941430348dd86b79dd2da5eb496cd71f7271cdbfc50bd533d4691f

SHA512
3d2f736edc7ffe3dde185684c361924b106e70f395dbff01c8c5323026e5c0c8cfe16470fa71aea90773cfa8713f715b7a2140b1f396d6dcfea381dd82f167f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8cd513127214e252edf0454f329bc002

SHA1
6f47fac6be8e7331e54203a7865e86b32cddf16b

SHA256
3df220380a8bf881117c17102a5c70ae7deea18ec92e7c478df2ee904d882108

SHA512
0b6d2f2e12bb8b15175875b7118778e57475934dee0476bc3ec989c5408d1ff5cf1c2d5dce4bd980a3ef9bfee232f974fa90050171826f3f0847f9682ae7e4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
371edf34cc4edfe5fc16d906571e1a49

SHA1
2b0f160569aff513f7ac25a16adf02758cca07fc

SHA256
ee07b7e150c132312f076f2fe4c58445fcf86aea9eda0468b6ee040b5f690d35

SHA512
9598bca019b2acf65bc0511062e8edf53e00b3801d7a9b49f9c6b7209bcf7ff782ec215716955d5f378f952d77435bccf210384909f28bffa83fa9ac8589cdb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
353d37133f0e5d32a8918f0eb3715121

SHA1
4a98d140c97a29db9e03f8d0d11d59c277402073

SHA256
dd62a1d79147497a9cf8b7ca33320fd0d1313f019ed77c3072670d2ea1c201fc

SHA512
163faf52147c729d6a9526b02e6da2f8b0c48169102d6936cc64d3c43d6757c0b7898b6237230934fdc9eefb21bc2f1885c2a84d91a226390aa00d047c04e570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd3b7e8f6cece301175174cef3b41fe2

SHA1
51ab55678778802abcd6aaa30896b23ffc001615

SHA256
04c94a79e9ac6175e7dd1901967b61afc027a616d33fabc3b25ba64e2b27d538

SHA512
f0f23197b6e196e619c76a0c49024416042fef420887e3c56942a13c75db6e5a748ea24102c5ec679a7b5cf020c9e84320848e9324f31c3cc55fea756c15ee94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
62a0631c5735c58e884708310c0b468c

SHA1
fd2c225e9179a9c52358ce44029cb5461a8e9daa

SHA256
c9124dac7b3b8b09d68942aeb54f093ad1f5bfc59c2db4cf4be02cfef522fcbb

SHA512
00e10510280bf481728ba7bd8deb3d27009d2412add2c391c14bb37571ada5352616a4a8da9f23057e078757f4ec41d4e359e902a6370b169cd7172cde5a7cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
685a49a1c4292b966faba121c0f1a187

SHA1
3f9ed6a18031ab110423d08dec92dde23eba57b8

SHA256
6fdc9367ebeaf3c5bf66be4a1fe6408adfbab1bd071449f59b1b8546266bb62d

SHA512
41cac9fc716d8f09778c860bf6420faf5f6684a066b33f5a55266978032945e00da7b2e001a81a2d5a153e9803df19441930950d8a1714b5199e289c8e9336c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe

Filesize
2.9MB

MD5
3f960b403cd616c9f59b3c22fc69aeca

SHA1
c9878d8dd7cada17525d0fb41626ef10387cb624

SHA256
8d0e9176ab99c1c4442f8529a5e06a84cf4573b79d21c15022f825ad9c36c84a

SHA512
bd48219ce56276114a411d4a3b19ff723cf20fe75571faebd43c2567b2a6cc73b77ffe5858ac5f80cec32d79ae3df84ebfc42b80b38af14691727f2c08399761

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v22.12.0-x64.msi

Filesize
29.4MB

MD5
106167d55e0bbfc7e2428f9aac1ef688

SHA1
b5c9f1b0cba46c3cdd3cd2e44c0404aa6aebe084

SHA256
5fa43604523be95f8e73c4c98337a5c2bf02450a6525ad25ec2926e464e6bcef

SHA512
064826799079725655b93abd7a3f5cf0e47c673e5f5b1b1951b2cadb8e3723bd80943e58c4d87ec0888c5f443d0093c8a39f09e21b3e7550928b1904b1181ba4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8bca4a0914a7b812e37b7ed2fb4242fd

SHA1
092f7650b7f58de31bfd620a572f8f0ed06eafc4

SHA256
da4bd5659b7fd00f068595e3c18475363434bf35c255c9f7ef9f390edf1b0777

SHA512
e03b8df9ce0f1f90936bff3eaa38863ba965ba5ec2e4a3c063cb9cdb7880397c8955d8221d3064e86cb3fdbe5e47f2dba6e0754870565cfbb871d475ade22f14

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
67435fbddddaf63514934bd666a43e8e

SHA1
223b8a8ce516ce2e574271e033d451591a42834c

SHA256
807b5be0be471bf965ba5640a29cdb2010db7b7173ef4cc793ee4479e69d26df

SHA512
62aa3d8ea1461faf3315b26d21de5e9bb9a8b419058fda3b0cd00b606f85986c46c5b0290438dfa658a22dec68ae5a0293df996ee6e1d99fb1322bb9123dd645

Download Submit
C:\Windows\Installer\MSI131C.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
C:\Windows\Installer\MSIDC66.tmp

Filesize
144KB

MD5
1b8c4d44b04e2f24230ff0541677e60a

SHA1
e8fb94c5071fc89579f8f2220d7556694006952f

SHA256
fd06ce976b1edac8cea2a1e4635a448652b793cb55959dc87f521ccf4c73f248

SHA512
2fb5b51b295ec52c61dba421073558c6e98906a3880777a51e54e72a94a7de3020f1de87b2909691bbb21048c6fe4bcc7568a61ca7c5b806969a0995e97a89a7

Download Submit
C:\Windows\Installer\MSIDCD5.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
memory/1268-0-0x00007FF86F503000-0x00007FF86F505000-memory.dmp

Filesize
8KB

Download
memory/1268-4-0x00000163C29B0000-0x00000163C29D2000-memory.dmp

Filesize
136KB

Download
memory/1268-6-0x00007FF86F503000-0x00007FF86F505000-memory.dmp

Filesize
8KB

Download
memory/1268-2-0x00007FF86F500000-0x00007FF86FFC2000-memory.dmp

Filesize
10.8MB

Download
memory/1268-1-0x00000163C0B60000-0x00000163C0C2E000-memory.dmp

Filesize
824KB

Download
memory/1268-21-0x00007FF86F500000-0x00007FF86FFC2000-memory.dmp

Filesize
10.8MB

Download
memory/4228-27-0x000001D4285E0000-0x000001D4286E0000-memory.dmp

Filesize
1024KB

Download
memory/4228-3045-0x000001D475010000-0x000001D475022000-memory.dmp

Filesize
72KB

Download
memory/4228-23-0x000001D40AAC0000-0x000001D40AAD0000-memory.dmp

Filesize
64KB

Download
memory/4228-22-0x000001D408C10000-0x000001D408EF2000-memory.dmp

Filesize
2.9MB

Download
memory/4228-25-0x000001D427F50000-0x000001D427F88000-memory.dmp

Filesize
224KB

Download
memory/4228-26-0x000001D427F10000-0x000001D427F1E000-memory.dmp

Filesize
56KB

Download
memory/4228-3031-0x000001D474EE0000-0x000001D474F92000-memory.dmp

Filesize
712KB

Download
memory/4228-3042-0x000001D474F90000-0x000001D474FAE000-memory.dmp

Filesize
120KB

Download
memory/4228-3043-0x000001D474EC0000-0x000001D474ECA000-memory.dmp

Filesize
40KB

Download
memory/4228-32-0x000001D427F40000-0x000001D427F4A000-memory.dmp

Filesize
40KB

Download
memory/4228-28-0x000001D427F30000-0x000001D427F3A000-memory.dmp

Filesize
40KB

Download
memory/4228-24-0x000001D427970000-0x000001D427978000-memory.dmp

Filesize
32KB

Download
memory/4228-29-0x000001D427F90000-0x000001D427FB6000-memory.dmp

Filesize
152KB

Download
memory/4228-34-0x000001D428700000-0x000001D428708000-memory.dmp

Filesize
32KB

Download
memory/4228-33-0x000001D427F20000-0x000001D427F2A000-memory.dmp

Filesize
40KB

Download
memory/4228-30-0x000001D427FC0000-0x000001D427FC8000-memory.dmp

Filesize
32KB

Download
memory/4228-31-0x000001D4286E0000-0x000001D4286F6000-memory.dmp

Filesize
88KB

Download
memory/5492-3464-0x00000246DAC30000-0x00000246DAC54000-memory.dmp

Filesize
144KB

Download
memory/5492-3469-0x00000246F5370000-0x00000246F5422000-memory.dmp

Filesize
712KB

Download
memory/5492-3467-0x00000246F52B0000-0x00000246F536A000-memory.dmp

Filesize
744KB

Download
memory/5492-3466-0x00000246F5730000-0x00000246F5C6C000-memory.dmp

Filesize
5.2MB

Download