hxxps://nodejs[.]org/dist/v20[.]1[.]0/node-v20[.]1[.]0-x64[.]msi

Analysis

max time kernel
319s
max time network
323s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2023 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nodejs.org/dist/v20.1.0/node-v20.1.0-x64.msi

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	4444	msiexec.exe
13	4444	msiexec.exe
18	4444	msiexec.exe
23	4444	msiexec.exe

Loads dropped DLL 7 IoCs

pid	Process
756	MsiExec.exe
756	MsiExec.exe
4596	MsiExec.exe
4596	MsiExec.exe
4596	MsiExec.exe
2816	MsiExec.exe
3964	MsiExec.exe

Unknown use of msiexec with remote resource 1 IoCs

pid	Process
4444	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\strip-absolute-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-edit.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\workspaces.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\color-support\index.js	msiexec.exe
File created	C:\Program Files\nodejs\install_tools.bat	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\encoding\lib\encoding.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\util-deprecate\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\config\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\buffer_list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\mode-fix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-adduser.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-exec.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\dependency-selectors.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\memoization.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\ssri\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-packlist\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\verify.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\map-workspaces\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\lib\write-json.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\mjs\brace-expressions.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-name\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\dist\yarnpkg.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\using-npm\scope.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\emoji-regex\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\repo.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minimatch\minimatch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-start.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-completion.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\events-once.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\load-virtual.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cmd-shim\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\cjs\processor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-repo.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-ping.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\map-workspaces\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\init-package-json\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\rollup.config.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\prepend.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-pick-manifest\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-hook.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\dependency-selectors.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-cidr\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\Xcode\Specifications\gyp.pbfilespec	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\center.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-update.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-dist-tag.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\types.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-publish.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\policy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_duplex.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\CODE_OF_CONDUCT.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-pack.md	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e589074.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B2E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8095.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8123.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C31.tmp	msiexec.exe
File created	C:\Windows\Installer\{FB5B287F-36A7-43A5-8F59-1417267129D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{FB5B287F-36A7-43A5-8F59-1417267129D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A1C.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9d6c693febb2fce0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9d6c6930000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900f9d6c693000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\URL\SourceType = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\PackageName = "node-v20.1.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\URL\1 = "https://nodejs.org/dist/v20.1.0/"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\URL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\Version = "335609856"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\ProductIcon = "C:\\Windows\\Installer\\{FB5B287F-36A7-43A5-8F59-1417267129D6}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\PackageCode = "C920D020C80B2F74983E4B39B8AE7945"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\F782B5BF7A635A34F89541716217926D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F782B5BF7A635A34F89541716217926D\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F782B5BF7A635A34F89541716217926D\SourceList\LastUsedSource = "u;1;https://nodejs.org/dist/v20.1.0/"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3392	msiexec.exe
3392	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	3392	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeMachineAccountPrivilege	4444	msiexec.exe
Token: SeTcbPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeLoadDriverPrivilege	4444	msiexec.exe
Token: SeSystemProfilePrivilege	4444	msiexec.exe
Token: SeSystemtimePrivilege	4444	msiexec.exe
Token: SeProfSingleProcessPrivilege	4444	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	msiexec.exe
Token: SeCreatePagefilePrivilege	4444	msiexec.exe
Token: SeCreatePermanentPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeDebugPrivilege	4444	msiexec.exe
Token: SeAuditPrivilege	4444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4444	msiexec.exe
Token: SeChangeNotifyPrivilege	4444	msiexec.exe
Token: SeRemoteShutdownPrivilege	4444	msiexec.exe
Token: SeUndockPrivilege	4444	msiexec.exe
Token: SeSyncAgentPrivilege	4444	msiexec.exe
Token: SeEnableDelegationPrivilege	4444	msiexec.exe
Token: SeManageVolumePrivilege	4444	msiexec.exe
Token: SeImpersonatePrivilege	4444	msiexec.exe
Token: SeCreateGlobalPrivilege	4444	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeMachineAccountPrivilege	4444	msiexec.exe
Token: SeTcbPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeLoadDriverPrivilege	4444	msiexec.exe
Token: SeSystemProfilePrivilege	4444	msiexec.exe
Token: SeSystemtimePrivilege	4444	msiexec.exe
Token: SeProfSingleProcessPrivilege	4444	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	msiexec.exe
Token: SeCreatePagefilePrivilege	4444	msiexec.exe
Token: SeCreatePermanentPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeDebugPrivilege	4444	msiexec.exe
Token: SeAuditPrivilege	4444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4444	msiexec.exe
Token: SeChangeNotifyPrivilege	4444	msiexec.exe
Token: SeRemoteShutdownPrivilege	4444	msiexec.exe
Token: SeUndockPrivilege	4444	msiexec.exe
Token: SeSyncAgentPrivilege	4444	msiexec.exe
Token: SeEnableDelegationPrivilege	4444	msiexec.exe
Token: SeManageVolumePrivilege	4444	msiexec.exe
Token: SeImpersonatePrivilege	4444	msiexec.exe
Token: SeCreateGlobalPrivilege	4444	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4444	msiexec.exe
4444	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 756	3392	msiexec.exe	86
PID 3392 wrote to memory of 756	3392	msiexec.exe	86
PID 3392 wrote to memory of 860	3392	msiexec.exe	98
PID 3392 wrote to memory of 860	3392	msiexec.exe	98
PID 3392 wrote to memory of 4596	3392	msiexec.exe	100
PID 3392 wrote to memory of 4596	3392	msiexec.exe	100
PID 3392 wrote to memory of 2816	3392	msiexec.exe	101
PID 3392 wrote to memory of 2816	3392	msiexec.exe	101
PID 3392 wrote to memory of 3964	3392	msiexec.exe	103
PID 3392 wrote to memory of 3964	3392	msiexec.exe	103
PID 3392 wrote to memory of 3964	3392	msiexec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I https://nodejs.org/dist/v20.1.0/node-v20.1.0-x64.msi
1⤵
- Blocklisted process makes network request
- Unknown use of msiexec with remote resource
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2F549E86920B04E83988A1756C26D388 C
  2⤵
  - Loads dropped DLL
  PID:756
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:860
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A1A9F6C791B693003F562E135E706A8E
  2⤵
  - Loads dropped DLL
  PID:4596
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AB83BE806FA36F5F87DECE3C5393A7CB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 57A049FA72745846F20A00F3EB10FAB5
  2⤵
  - Loads dropped DLL
  PID:3964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589073.rbs

Filesize
854KB

MD5
b028d9cd79bf28f57fa0eb367c7fc389

SHA1
536aa5805e418748d214c37b6b3940aa2f4278a3

SHA256
4f8acb19b102bb5d4b1bc0358f59dada1fe6797d06d9cbd071d6e31f2fa741e2

SHA512
76cc9ddb3b44406c68ded46e49a32ccbc8162a33316439c40916fac58441bf17e49ef67be8fbd5ae5119fabee83bcaad87c687f629ad6b2e8ae1ab2cead7caf4

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\clean-stack\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE

Filesize
11KB

MD5
d273d63619c9aeaf15cdaf76422c4f87

SHA1
47b573e3824cd5e02a1a3ae99e2735b49e0256e4

SHA256
3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5

SHA512
4cc5a12bfe984c0a50bf7943e2d70a948d520ef423677c77629707aace3a95aa378d205de929105d644680679e70ef2449479b360ad44896b75bafed66613272

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
167B

MD5
9f2e8894b59734d36a653f3e4bdff78a

SHA1
fd2176ad906e8adbfb298ce878db92742b4a9bde

SHA256
9f56c1f4accdaac51a1d04b436b6302c95c14a5fd5fea0325ab50d7ddf3aa95d

SHA512
a12122dfb9cf7dc47ddb103d1c385e1967e756176f126e206643427626abf689134675ed16fd5ca38e81fc025820d17a8d7e7f4ccc415eff67e8b6d871e1bb24

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
80457cddf28df9659134db40458e9230

SHA1
14dc2d9c69ed09cd3812b61920b2e65e31d26bd5

SHA256
074fc2a5e9366cfa01641893f1c1fc4384e60eae4c7f281bf17c282e72e15f01

SHA512
bc925916389e196f1ccb4dba3641829a533d0fa0a0478789fee8d4d62a9c10e07b92cb47e21b131119a658cebc9f943c703de9312b78ce4dc328dc96c5fa82cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6

Filesize
471B

MD5
80078bf178bf5594a3f63f76e415b977

SHA1
21c2f1695937b8572a0ad611d35bb9a81e027e53

SHA256
2c069d454750fc39af594f742d808847c287ec55a7085a403fa256baa9c904c3

SHA512
7708b3947827cb9086c4794d716ff68f26759434e33fde80e2981fc42ae0ed2a4c95b49eb3cddca5422eaf461c433c212de9bdd4f658c10f5d611d86f0c37a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
434B

MD5
8aa8076b58c14f337348f068e5898520

SHA1
293efe683ecd1cc27aed967acca5710dfc96a093

SHA256
0cf225e06926ec8a43e7b3bf6508aae71487567ccddfc7e81d03751d63c2b8e0

SHA512
8d1f2f4fbef9a70d5dd09a075849d60354bf7fb8ed4f60ac057225037a197d338899fdd00124e9b4ada63c85620bb68084f8fdd1df939fa2999ad4f1a52ffc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6

Filesize
434B

MD5
1919929d880017252071c246f8219604

SHA1
d2fbae185d24b1660d5b59b29ae81cee203a0186

SHA256
199716ceb1d9ecf2fa686df32ae8a7f63214585fbad5514c5cc457c8f72da1c3

SHA512
5cdb8ae20182ec89523e5c4d7454cd85ccbce0ddd0a7a2bc29850a5e662d25603b87cda92636abc76854f44e9893b078b1af2d353402b4d5829d9ace018bf189

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9E78.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9E78.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA0AC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA0AC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSI8095.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Windows\Installer\MSI8095.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Windows\Installer\MSI8123.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Windows\Installer\MSI8123.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Windows\Installer\MSI8123.tmp

Filesize
123KB

MD5
1bf36bd040148642f6980433d8d13bba

SHA1
7b59a44ab4832a48ff6120e62d75a8e0a931f10e

SHA256
2ccad6fd6f59dbae58ad4ef384812831bb43fb28ea8c327e1d78ffe08d6efea2

SHA512
d8d71eea30cba71e4323554e0599fb0bfb014ddfe58717bd153713c4b00e5be4005aa4650e0f150098d0065772aaa20959ecfd222e415f007879579ec2312cb0

Download Submit
C:\Windows\Installer\MSI8B2E.tmp

Filesize
25.3MB

MD5
122dd5712be269e50024dc1e7b5d71a6

SHA1
92fca3251dac6efbd8e9f5d6b12f2b072f332b9e

SHA256
9e26806f7a99ffb5725f4f08e1f51fcd2522d17b180eced25094d5aed75b42f0

SHA512
d687ca3cdab37515cba928193de9a45816d2541ad3bd46ec84172702d81fc70b437bc094db4ae8d53088c10c32376eae8702e00313f96680b2cd52404d8cb6e3

Download Submit
C:\Windows\Installer\MSI8B2E.tmp

Filesize
25.3MB

MD5
122dd5712be269e50024dc1e7b5d71a6

SHA1
92fca3251dac6efbd8e9f5d6b12f2b072f332b9e

SHA256
9e26806f7a99ffb5725f4f08e1f51fcd2522d17b180eced25094d5aed75b42f0

SHA512
d687ca3cdab37515cba928193de9a45816d2541ad3bd46ec84172702d81fc70b437bc094db4ae8d53088c10c32376eae8702e00313f96680b2cd52404d8cb6e3

Download Submit
C:\Windows\Installer\MSI8C31.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSI8C31.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSID0CC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSID0CC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSID0CC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSID6A9.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
C:\Windows\Installer\MSID6A9.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
68f168c1c7dea4c46bca4c7188ef7b1c

SHA1
b1009e3e060956010f333bc89c34e9aca7aad603

SHA256
d15602cc3d4d2c7ef03d51295b45bfd45723cef4ffb844cb08b0ed1dbd5e3bb1

SHA512
780c8b29b06bc4cccaf5ea0447907c8be0080a429faf33ea1560659850a0be8dcf2c2c76f52974621b23fbb3eded1989d432246be8b64c75d997bc06f3876587

Download Submit
\??\Volume{93c6d6f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2ca6b95e-d703-4104-aac4-c09c941d8b26}_OnDiskSnapshotProp

Filesize
5KB

MD5
f413fb1e7eb166692a5ee319bbeba2b8

SHA1
cd9ae1dcc69340f85e7e38e2ed79df061eafeaae

SHA256
b10c58988402b29fbb87d8bdf04efceced617925b98743b3a51874269fe28f8c

SHA512
6bdb309ab85416f310f71776f964b3b57144018919dc6294dfcf7649d49c15336ebfd89cee46b0b7a234e0991f0c4c9743d085231063b53e88c463f43f71121e

Download Submit