Analysis Overview
SHA256
b46ffd5eaa28f8b42970d4b9ac5b5dfab5306e8393676fe6a29ed1e23ab36e80
Threat Level: Known bad
The file app.asar was found to be: Known bad.
Malicious Activity Summary
Epsilon family
Detects EpsilonStealer ASAR
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Enumerates connected drives
Drops file in Windows directory
Drops file in Program Files directory
Browser Information Discovery
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Checks SCSI registry key(s)
Suspicious use of WriteProcessMemory
NTFS ADS
Opens file in notepad (likely ransom note)
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Uses Volume Shadow Copy service COM API
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-15 19:18
Signatures
Detects EpsilonStealer ASAR
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Epsilon family
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-15 19:18
Reported
2024-09-15 19:24
Platform
win10v2004-20240802-en
Max time kernel
316s
Max time network
317s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation | C:\Program Files\nodejs\node.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\nodejs\node.exe | N/A |
| N/A | N/A | C:\Program Files\nodejs\node.exe | N/A |
| N/A | N/A | C:\Program Files\nodejs\node.exe | N/A |
| N/A | N/A | C:\Program Files\nodejs\node.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\System32\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\MsiExec.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\O: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\System32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\System32\msiexec.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-adduser.md | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tlog\client.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\types.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\path.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\p-map\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-repo.html | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\cross-spawn\lib\enoent.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\markers.py | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\LICENSE.txt | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\bundle\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\src\factory.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\nodevars.bat | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-edit.html | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\lib\utils\npm-usage.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\foreground-child\dist\commonjs\all-signals.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\npm.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\safer-buffer\tests.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\lib\commands\sbom.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\exponential-backoff\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\ignore.d.ts.map | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\lib\abort-error.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\win_tool.py | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\man\man1\npm-owner.1 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\lib\extract_description.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\lib\reporters\detail.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\ip-regex\license | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\lib\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tsa\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\file.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\opts.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tsa\client.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\aproba\LICENSE | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\src\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi-cjs\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-diff.md | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\version.py | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\lrucache.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\intersects.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\logging.md | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-run-script.html | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common_test.py | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\index.es6.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\should-print-patch.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\neq.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\output\using-npm\scripts.html | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\events.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-dist-tag.md | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\tar\index.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\api\field_behavior.js | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\README.md | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\package.json | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\deprecated.json | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Installer\MSI7900.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\inprogressinstallinfo.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8100.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI78B1.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{58F1F522-8764-4F2F-838F-525592ADC278}\NodeIcon | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{58F1F522-8764-4F2F-838F-525592ADC278}\NodeIcon | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\e59771a.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSIA3FB.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\e59771a.msi | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\SourceHash{58F1F522-8764-4F2F-838F-525592ADC278} | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8362.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\e59771c.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSIA738.tmp | C:\Windows\system32\msiexec.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\MsiExec.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a54fc9f1d525247c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a54fc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a54fc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da54fc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a54fc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr | C:\Windows\system32\vssvc.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E | C:\Windows\system32\msiexec.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 | C:\Windows\system32\msiexec.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\corepack | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\AdvertiseFlags = "388" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\Clients = 3a0000000000 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\DocumentationShortcuts | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\EnvironmentPathNpmModules = "EnvironmentPath" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\PackageCode = "5229DDCD3A438F043AE4C426ECEF4463" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\Assignment = "1" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\InstanceType = "0" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\ProductName = "Node.js" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\DeploymentFlags = "3" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\225F1F854678F2F438F8255529DA2C87 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\EnvironmentPathNode = "EnvironmentPath" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\Language = "1033" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\Media | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\NodeRuntime | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\AuthorizedLUAApp = "0" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\ProductIcon = "C:\\Windows\\Installer\\{58F1F522-8764-4F2F-838F-525592ADC278}\\NodeIcon" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\Net | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\npm | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\PackageName = "node-v20.17.0-x64.msi" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\Media\1 = ";" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\225F1F854678F2F438F8255529DA2C87\EnvironmentPath | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\225F1F854678F2F438F8255529DA2C87\Version = "336658432" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 | C:\Windows\system32\msiexec.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 730766.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Notepad.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\System32\msiexec.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\app.asar
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9faa246f8,0x7ff9faa24708,0x7ff9faa24718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5964 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v20.17.0-x64.msi"
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 315E606BAAC1B18EC96061BE80EF41D2 C
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 317F8F8ECE97188AC857E9EA69D3C26D
C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 3DE2FEF4664B963F51EC67CE74E692FD E Global\MSI0000
C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C5198D37E802C481B12C9DC2203293DE
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5792 /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
C:\Program Files\nodejs\node.exe
"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
C:\Program Files\nodejs\node.exe
"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i -g asar
C:\Program Files\nodejs\node.exe
"node" "C:\Users\Admin\AppData\Roaming\npm\\node_modules\asar\bin\asar.js" extract app.asar app
C:\Program Files\nodejs\node.exe
"node" "C:\Users\Admin\AppData\Roaming\npm\\node_modules\asar\bin\asar.js" extract app.asar p
C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\p\src\index.js
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap19891:74:7zEvent5971 -t7z -sae -- "C:\Users\Admin\AppData\Local\Temp\p.7z"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,4951240525487509551,793117039161927562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.242.123.52.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| GB | 92.123.143.114:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 114.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | r.bing.com | udp |
| US | 8.8.8.8:53 | th.bing.com | udp |
| GB | 92.123.143.139:443 | th.bing.com | tcp |
| GB | 92.123.142.43:443 | r.bing.com | tcp |
| GB | 92.123.142.43:443 | r.bing.com | tcp |
| GB | 92.123.143.139:443 | th.bing.com | tcp |
| US | 8.8.8.8:53 | 139.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | aefd.nelreports.net | udp |
| GB | 173.222.211.40:443 | aefd.nelreports.net | tcp |
| US | 8.8.8.8:53 | login.microsoftonline.com | udp |
| NL | 40.126.32.74:443 | login.microsoftonline.com | tcp |
| US | 8.8.8.8:53 | 40.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | nodejs.org | udp |
| US | 104.20.23.46:443 | nodejs.org | tcp |
| US | 104.20.23.46:443 | nodejs.org | tcp |
| US | 8.8.8.8:53 | 46.23.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cloud.orama.run | udp |
| US | 172.67.166.61:443 | cloud.orama.run | tcp |
| US | 8.8.8.8:53 | 61.166.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| GB | 173.222.211.40:443 | aefd.nelreports.net | udp |
| US | 8.8.8.8:53 | 7.6.57.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | registry.npmjs.org | udp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 8.8.8.8:53 | 34.25.16.104.in-addr.arpa | udp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 104.16.25.34:443 | registry.npmjs.org | tcp |
| US | 8.8.8.8:53 | aefd.nelreports.net | udp |
| GB | 173.222.211.41:443 | aefd.nelreports.net | udp |
| US | 8.8.8.8:53 | 41.211.222.173.in-addr.arpa | udp |
| GB | 95.101.143.202:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 202.143.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | r.bing.com | udp |
| US | 8.8.8.8:53 | th.bing.com | udp |
| GB | 95.101.143.193:443 | th.bing.com | tcp |
| GB | 95.101.143.193:443 | th.bing.com | tcp |
| GB | 88.221.135.0:443 | th.bing.com | tcp |
| GB | 88.221.135.0:443 | th.bing.com | tcp |
| US | 8.8.8.8:53 | 193.143.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | catbox.moe | udp |
| US | 108.181.20.37:443 | catbox.moe | tcp |
| US | 108.181.20.37:443 | catbox.moe | tcp |
| US | 8.8.8.8:53 | 37.20.181.108.in-addr.arpa | udp |
| US | 108.181.20.37:443 | catbox.moe | tcp |
| US | 8.8.8.8:53 | 28.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e765f3d75e6b0e4a7119c8b14d47d8da |
| SHA1 | cc9f7c7826c2e1a129e7d98884926076c3714fc0 |
| SHA256 | 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89 |
| SHA512 | a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079 |
\??\pipe\LOCAL\crashpad_4352_FRUJHGHNTZDHAELE
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 53bc70ecb115bdbabe67620c416fe9b3 |
| SHA1 | af66ec51a13a59639eaf54d62ff3b4f092bb2fc1 |
| SHA256 | b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771 |
| SHA512 | cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8746a4db4bf0c4c39ed5dae408398c25 |
| SHA1 | 900932aea208f2e39c83164235389b5e9611bce1 |
| SHA256 | ee7da83563378fcf672a092adccdae729e33a5a2d9a31d582da4867263f522b6 |
| SHA512 | 796f3ed1c934f18954bc55dd52d294b3e36edfef1b35c097ba6b02c444bfe7ccf74c95429065122831849f7485606163ea7dc8f4e54fa3f65ab8f02f64194b1a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | a7ad3c80bdea9e44c19202516c692165 |
| SHA1 | 12e1c3acd2eb2f446176a77e1959ff9093f0c287 |
| SHA256 | fc5927205b30187e0010923e0312973b7fd777c7a9eeb3267a9f9e7ee20b956d |
| SHA512 | 9ab50f17899894536f2b22da63ffc4875f6c0034677bfc01121a5c4d009853c9da0f2c4011c6e29032a1809e3d5761dbbb7d608cd2140d002a2bf0d0364816ce |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a101c03261b79fe3934ff4f8b4259d8e |
| SHA1 | 81ed52f6f74d4284c516cedd417fab30aa792aae |
| SHA256 | b643c9c2d5a71e100e8fa24a143d16a44cd5743752a0c04c7a073a674a7e39e4 |
| SHA512 | 4c1e84e334f09ad0bd8ce2ab789a90d8c2bd26ead5ca9f32c23b9d07ec9ce0fd0ec38b06f71276a1b45d6cb300f53dbc5a73586c6b6e144ca40eb444c5490391 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6f326f35aaeda3dcb6a02820f53a1e9c |
| SHA1 | 87bd8134a20ab0836c7efda340d89f48eeaec918 |
| SHA256 | 98b631af8d773741886b52c434b670b16b5c3e020de83c1f6ea3d63cac7665c0 |
| SHA512 | 7d596e508989493b39c3ae4b8c74da320135961d5ddda375d41a6645ae2d700fbdc34c0114bfa4652d2318bba5048fd23c02de5c6c727bed73814d4184da5612 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0adbf5a2b712f772383b6c28f7bfb686 |
| SHA1 | 8a068a65ebbbc500253642a966c0c6e0bead830e |
| SHA256 | 89f3260a3a5f38d382ecc242bd05ae9c2235ff1c4594bd839f01862d21117eed |
| SHA512 | 86c3ddf1028030793c30b0315c4088a5ffdfc987e81784bdf00d4c30e93f315bdb48a713cae033feb0554f5db557bdda7b23b2ab0fdca88f728bf91500d246af |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 730e07019fdb26d60116ae41fb20d614 |
| SHA1 | dca422d2e64b7984e0c69b212c60b9c731fc5574 |
| SHA256 | 676c8bf880dae40256e26c3e14231e00b7c1627c67413a97a592c230702b5344 |
| SHA512 | c3373f8d719b4fd6c7e7e813bdd1d5a274fa171c7606782f1104a1e339e1210bdb89d0117e1ee6e85839f03a65ac599acdf2d1659a0a91bac3a219aff3c0fca7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 095cf238f19218e0ebd06868869fe972 |
| SHA1 | 50bb89d6a6ef98df347d94b9484772f1a89087ae |
| SHA256 | 904078e588a9a453b260dd14de678ae726bce78dc847e9f4e5c799b1081fa093 |
| SHA512 | e214cf38e2011cbe1699e45984b0f608e7a18a6120ed8bb3c664c68956969fb0abd6d50e18d18ffb3e2b3abaf37d30b1ccf32b19694daf04ce421285bab42bf7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c128.TMP
| MD5 | 0d046918a9048e960962b90a5ab247bc |
| SHA1 | 7b30b88cdb3e17b8dab617da0e0b1efaf6c47b76 |
| SHA256 | 4c40090e074ea841604f4f8ec14137ec9ff8f9f27ff60b177c695ed2c7a358ee |
| SHA512 | a19e4d55e1e9b9f0245cd329c880cb33837c6f029a29a4350d04fffac309aebe1d639ebc4d8f02c9ffe6f586dbde69b3706183366a246181170cc63eeee29a79 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7909d0f8c308b15ec200bd99df1ce565 |
| SHA1 | cffad263e2a0b12426b70058f5d5cb3660482664 |
| SHA256 | abe05d3b31257b09b5e3e0b17e89a14e13f8e93c7a22eeb628ef223aee1565a4 |
| SHA512 | f1b5ec86b75f8b6c1ad9e2fa7b65418d1f42bfcfd9d46a2e56ed738e90d26ef56437ce3ff18010ed5066d2a9d325f0eda9e072fcf945e65c868c99f6e382f9ae |
C:\Users\Admin\Downloads\Unconfirmed 730766.crdownload
| MD5 | e052900bedde38a22518d15217092cf7 |
| SHA1 | 4178847d928a8c7d90934503abad91a3f0aa3bd0 |
| SHA256 | 8ba4cf21d15bf47cf36d77a41058d12f8a7b4d333164618f3b2e6a52a1f226d5 |
| SHA512 | 1b190e1839ee1ae27c25a800daf60c5b61c50d467a0bc09b9eb2f1976049c24935261cf2990d695c9adbac5331299b21d394b85c623766d3a809f16f933ceb73 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3798408a458989a452a1b31f048f0615 |
| SHA1 | bf8256928f16199ca4c52cc1cce68a922e3071d0 |
| SHA256 | bd6f45599724b0fc7b018f4b856ec067785681e1e80f9205158ad87e1da32738 |
| SHA512 | adbe5aaa9b6fcba9beb79a08c74f92086028b50b01490a4abc8ab9c5e4768004a4a4dc9d92eaab6394866e5ad1a6bb77e6260932338b3bd9cd7d24cf091b0cb9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 8daae89a5520ce22f79aa57c8f0523be |
| SHA1 | a1642a9c786c0711e4c22d1642d192a9f920ae9f |
| SHA256 | 99d2a1a0b5f57733d2d3671147c8d4d5646c07f40ed7a84f6b7f02aaa43911e5 |
| SHA512 | 462f3c0cb17e334c4e8c8dc19de8f514b62b32d8dbd3562d89f369ada50794ed2736463c710d66aa3e7f8f8f4690862e360727e58a48b10c6863dc93a53981fe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 571aa4790f2f70d5e3b433802622ae76 |
| SHA1 | eff4e62240a0f53ac1baddfb705ed3a10c326b23 |
| SHA256 | 4ca8ce99ed8bd30223b2bb928b24838773cf50cd3c2c5cbdc123d780ab4605f6 |
| SHA512 | 29052eee1b5a6225bc21ca053435b9c6b181a8b3c819446528b0262fb565077a6c8e06926d1f25ebcb2d3081a49a1b59705df9df6b6f84c1038dd95315911b7b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2775f443f72b6d4563454f1dcc4abde4 |
| SHA1 | b5c6cb05e8a70b9cc5b8ddd7a540d7fdce33c08f |
| SHA256 | 3d7ce459e9e19815b4453cc483942e51fe628cb0ed33539724fdc0d136b606b8 |
| SHA512 | fb67d133e214436cf6ec7cddb2d809d61ba14be60b5fb653e36493d319663b8bb70930618969520c1f3879c4ce317569ae29e49f45f760a53592bb87aa0f7bc1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
| MD5 | b6ca8f76b42c9ab28e37580cc0bdd5e9 |
| SHA1 | 7745044948e779c12aa44b418f45663bbb7810f2 |
| SHA256 | e611d64157ea958fdf03e5df3202843871b2c20f3ba1fbec78d07047cdc31bf2 |
| SHA512 | 2dbc94e1083c69f04f82e378b5cf44f6d9fc9bd93c09972e3325b629039c270dadfec6b2e27cc896e024b9f9b0f3fd48c6d6a569494a158bc6b3a7108acaa27a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
| MD5 | 289c7d66f6f79d275793be5bb7e9e71e |
| SHA1 | a26e57cda44b45a9d7291208490d238a809358fc |
| SHA256 | 40dc39d6992ed78bad0177b556018be674fe02c6f3000d63f207d4061b506af4 |
| SHA512 | de70b16f94ac55cbf042a6434facdf4518f62f5f1a10990f4392510f5e65c544419e2464ddad3ea45658f5a40237c24a9a7c2f0e0b99fc36d68b1e82cc1b4f90 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | c8c4af1c4aeb585a86e26a089edf27a8 |
| SHA1 | ec1975e380a97be65cb514e6c648b47e7dc315ac |
| SHA256 | 8d97ee5b8a1f1ff9c853e7b6a1c8590405c2a5fcc48884ebfb9e584492d565c2 |
| SHA512 | a63ac7ff688e68a1c8c058fbc0514f0c373851e474da6ca408778334ced41739387575edbe24afa79885148d187fd08703d22d4ec363732bc1fec80ef5b26368 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | 1e02c4c6095fd7a9ba19f490790676bc |
| SHA1 | d0381bdabd0f3a24bb77144c66d8bf2c94d84698 |
| SHA256 | 23a7ad5ebd65a0fd434e47e8ac4766e463326802d322bb25c2128dd7aae06155 |
| SHA512 | e059da25e91525804cb017c365b78b3e5598e46edafe0be6447ff64477530c26eaaa27b7333e19441d44cb5931710669855b019d4ad90f4fc7c078cb5a6782e4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | 599d5baadee542a68f82f240e998e69a |
| SHA1 | d56f23cdffccf1ce245031ea879b5a3dcb40d306 |
| SHA256 | 39cfbc4bef1434ba645ff2c1499d0385590a4d3f26141724d664d4b9f80bdbb0 |
| SHA512 | 228e3cd4e7cbe2bbb10136ead01d7dfb3cacb9211869dfcb1c9b63064fa8345bb3f299807e2c08ec4f98dd2a6771ac288be5b172156ceb0fd02a12d5eccfbdda |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | 3b56d86ada9b7233ebf659e2fff5391c |
| SHA1 | ff4de508a8eff74a62a4d831091c3578819d5722 |
| SHA256 | 2e3355d45958807bb45e4e2217ead25d9b6ed48306932df834b5ee80d7950c49 |
| SHA512 | a5f4489084bb425aaa207eedf00d126062c3e04f03c18ceba71c56d6d97cedf9d97b69a95f14fcc3ff191882c78bd34e1eca96237e7412ce80a0e69b459e67f9 |
C:\Users\Admin\AppData\Local\Temp\MSI141B.tmp
| MD5 | c40c85af0d5259a3fe92b84acb35d578 |
| SHA1 | 47219e725893cfa54d24a3ee38e1a1046c5ef910 |
| SHA256 | d09b02b74a28f98edb808817e6975c0fe5dd3855c9daba289c07b8d2ead87839 |
| SHA512 | f01fc216f5160c69ecfaabf840d06486533fe13a4c369549849965bb124e54d1a25f7cc035e960a0aa0f66eff4b807ec454a09c98203ddaa8256d7359960c9f2 |
C:\Users\Admin\AppData\Local\Temp\MSI1506.tmp
| MD5 | 80bebea11fbe87108b08762a1bbff2cd |
| SHA1 | a7ec111a792fd9a870841be430d130a545613782 |
| SHA256 | facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1 |
| SHA512 | a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6c606bb82d2f9b7271bc30aa2269d8b0 |
| SHA1 | 57176a8a8a0c29dde48b2d818cb064c44af477c5 |
| SHA256 | 3f8237836fa3fa25e61fe483ee4e0baa551dca7f8ac15fd190b2cd3f118ceb5b |
| SHA512 | a64876f6ce10ef180baaa40d71bce66b6cf510af0f61550e64992ddc935cba77bf4fc7f28f545f4cad6cb2b81e41752e947a72b90c9e50ed015012582c624d4d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b2125a144d0ef13c2dc9698cfa32d6a7 |
| SHA1 | 482c29b742c95a258fd080d16b32f7fa733838a4 |
| SHA256 | 87b27ffdfbaa3df6b252e341356157779521cd199d49b8bf8845950b315945bd |
| SHA512 | 3de8abc5e6442bf43eea346daf7ef3134257fbcaa5fbea2f358665b52b02053c3aade8d60ec7802558ffce2ae3696883e43b0e568f276373244970ea6f19104f |
\??\Volume{f1c94fa5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{946eb7ad-d98d-4a18-9661-32a71227dd63}_OnDiskSnapshotProp
| MD5 | 379d541496680411790434fc64cf9e2a |
| SHA1 | 146019bae9f822d0949084a07e53de03fb595a60 |
| SHA256 | 86824a35c3b7f91f50d4d2ed3e579df3f5ddb3cf230537af5a51a792fb31165b |
| SHA512 | 46e910d5c207ce5a78147d52c59b1c648a14d72cb39e2aa65a02fa734a7a15c180a6cf3bfdcc98c55e1815a7ba4c64d92643de72acbe39477c15a9e22998bafa |
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
| MD5 | 4a7620865dc9836abb1d339748ae2a82 |
| SHA1 | 762d89082c7a7d95d5b87f277a8358bfabd88c16 |
| SHA256 | cf1a4b788eeffeaba849822c63ff7794a786e14914dbb38e6e8ed8ec68485237 |
| SHA512 | b3f7c4136a0ed59222308d7615dd600b59e99ab1e90020cc290896130085b3773e70b07db5355e20e33810cd56ba64a696b28e15f7165e8af56a4c08ed8748b4 |
memory/2356-397-0x0000019593FA0000-0x0000019594A61000-memory.dmp
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
| MD5 | dfc1b916d4555a69859202f8bd8ad40c |
| SHA1 | fc22b6ee39814d22e77fe6386c883a58ecac6465 |
| SHA256 | 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9 |
| SHA512 | 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa |
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
| MD5 | 24563705cc4bb54fccd88e52bc96c711 |
| SHA1 | 871fa42907b821246de04785a532297500372fc7 |
| SHA256 | ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13 |
| SHA512 | 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9 |
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
| MD5 | d2cf52aa43e18fdc87562d4c1303f46a |
| SHA1 | 58fb4a65fffb438630351e7cafd322579817e5e1 |
| SHA256 | 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0 |
| SHA512 | 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16 |
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\license
| MD5 | b862aeb7e1d01452e0f07403591e5a55 |
| SHA1 | b8765be74fea9525d978661759be8c11bab5e60e |
| SHA256 | fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f |
| SHA512 | 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f |
C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license
| MD5 | 5ad87d95c13094fa67f25442ff521efd |
| SHA1 | 01f1438a98e1b796e05a74131e6bb9d66c9e8542 |
| SHA256 | 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec |
| SHA512 | 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3 |
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\LICENSE
| MD5 | b020de8f88eacc104c21d6e6cacc636d |
| SHA1 | 20b35e641e3a5ea25f012e13d69fab37e3d68d6b |
| SHA256 | 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706 |
| SHA512 | 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38 |
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
| MD5 | 072ac9ab0c4667f8f876becedfe10ee0 |
| SHA1 | 0227492dcdc7fb8de1d14f9d3421c333230cf8fe |
| SHA256 | 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013 |
| SHA512 | f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013 |
C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\commonjs\package.json
| MD5 | 56368b3e2b84dac2c9ed38b5c4329ec2 |
| SHA1 | f67c4acef5973c256c47998b20b5165ab7629ed4 |
| SHA256 | 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd |
| SHA512 | d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482 |
C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\package.json
| MD5 | 2324363c71f28a5b7e946a38dc2d9293 |
| SHA1 | 7eda542849fb3a4a7b4ba8a7745887adcade1673 |
| SHA256 | 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4 |
| SHA512 | 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677 |
C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
| MD5 | 2916d8b51a5cc0a350d64389bc07aef6 |
| SHA1 | c9d5ac416c1dd7945651bee712dbed4d158d09e1 |
| SHA256 | 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04 |
| SHA512 | 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74 |
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
| MD5 | 7428aa9f83c500c4a434f8848ee23851 |
| SHA1 | 166b3e1c1b7d7cb7b070108876492529f546219f |
| SHA256 | 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7 |
| SHA512 | c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce |
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
| MD5 | d7c8fab641cd22d2cd30d2999cc77040 |
| SHA1 | d293601583b1454ad5415260e4378217d569538e |
| SHA256 | 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be |
| SHA512 | 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764 |
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
| MD5 | bc0c0eeede037aa152345ab1f9774e92 |
| SHA1 | 56e0f71900f0ef8294e46757ec14c0c11ed31d4e |
| SHA256 | 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5 |
| SHA512 | 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3 |
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
| MD5 | d116a360376e31950428ed26eae9ffd4 |
| SHA1 | 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b |
| SHA256 | c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5 |
| SHA512 | 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a |
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
| MD5 | 9841536310d4e186a474dfa2acf558cd |
| SHA1 | 33fabbcc5e1adbe0528243eafd36e5d876aaecaa |
| SHA256 | 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9 |
| SHA512 | b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783 |
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
| MD5 | cf8f16c1aa805000c832f879529c070c |
| SHA1 | 54cc4d6c9b462ad2de246e28cd80ed030504353d |
| SHA256 | 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573 |
| SHA512 | a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
| MD5 | 35b86e177ab52108bd9fed7425a9e34a |
| SHA1 | 76a1f47a10e3ab829f676838147875d75022c70c |
| SHA256 | afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319 |
| SHA512 | 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62 |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
| MD5 | 4703a5862f7547fda2dc31d1c0eb69e6 |
| SHA1 | fffc48cca9cba54654ddfae1b0b773c9f56e2e40 |
| SHA256 | c95de19f2c624eecff19a6eb1f81b99717b2be87a4373cada4e56620463ddc60 |
| SHA512 | 43eda27705db668fe7102a0a80317ccf25bab380fd63094a7faa54840a7b71acb676c3563cac1942f7279f738c859db244bf0cca9988874df745d68c4482ce9a |
C:\Config.Msi\e59771b.rbs
| MD5 | a9b4f2153f9ab3d8f59a5a2f6ee051af |
| SHA1 | 77df4fe34fd43b5f47d51a61a521412e4a7dfc26 |
| SHA256 | c41744a5fc6f48a86690fb748330b7a6940ada29144b5b0dd9cb538efd06e14c |
| SHA512 | 3c0194801c82b15b10fec377dbd905db8cd6c2cc4c20f4f576dd7c7cbb390dcd533602bfdc8a46c23c7700d4b52e7d757b021ff1bb3983afd66b9278e18d98b5 |
C:\Windows\Installer\MSIA738.tmp
| MD5 | 74528af81c94087506cebcf38eeab4bc |
| SHA1 | 20c0ddfa620f9778e9053bd721d8f51c330b5202 |
| SHA256 | 2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34 |
| SHA512 | 9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae |
C:\Program Files\nodejs\npm.cmd
| MD5 | 6895fc6423c97fbf721a71333137d1ca |
| SHA1 | e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e |
| SHA256 | 21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8 |
| SHA512 | 0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0 |
C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
| MD5 | 92dd1b5a463374142271ff420cb473a5 |
| SHA1 | a9f946c6a8c6f273f837703acc74c367b7781a99 |
| SHA256 | 673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e |
| SHA512 | 5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01 |
C:\Program Files\nodejs\node_modules\npm\package.json
| MD5 | 6b62acf12be60413f0cbee4d3a7f8ec4 |
| SHA1 | 52938c2a144909c726acdf864dbf63b326503af5 |
| SHA256 | c24c86166b39e4a7df131f03a8bbe904703de8fad44485bcf527d4de7806d6c6 |
| SHA512 | 996bfa85f543eedfeb89c785c768d9c353d84f418fdc7b4942df5d3eef7f80c64307b11f6621e95c8f6913c9d9ba56f45871b37a4ec219b123a1e1c040de9c89 |
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
| MD5 | 12e81622441869a53e41506dddfafe4e |
| SHA1 | 71c0a5cb389c931c668eb7a5e66ed38e3ba65c5f |
| SHA256 | 8e3bdc96f4c3910caa78ffb5601630aabe5fdb4b6344184cd1f24f8b8b3b84f9 |
| SHA512 | 898dd31d2424cd8f647d0e045db579159f9596259fd2b295f5d1125e9323699b05faaebdcf1f148e468fa3534204ca45de961ca706780d0f1100fd4efea25742 |
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
| MD5 | a2819bc319ade96e220b81c11ba1fd62 |
| SHA1 | f711920489d12ac7704e323de4cea98009299e7d |
| SHA256 | 9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e |
| SHA512 | 64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32 |
C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
| MD5 | e6b2ad09f00a37da8012022f4b9e0461 |
| SHA1 | 9af557e76ab4036536d792ca9b3c37d4720c0587 |
| SHA256 | 2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4 |
| SHA512 | 9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7 |
C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js
| MD5 | 54bd6e9d21ed6021e374d34cfaa3290c |
| SHA1 | e71ef5c7bf958f1599fce51cc98a73f849659380 |
| SHA256 | 4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036 |
| SHA512 | 7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407 |
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
| MD5 | 94443c174d88f844a9ccc4b910f630cc |
| SHA1 | fcb80696d47cad01738194971bc75c5e249044ce |
| SHA256 | ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56 |
| SHA512 | 1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa |
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
| MD5 | 1d97bc3d56be902d4f63b37b05f3ad85 |
| SHA1 | ace1fd823fc44e12a25448db2b5a49e20973e506 |
| SHA256 | 0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46 |
| SHA512 | fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee |
C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\package.json
| MD5 | aa721fce40b4331d0ded9cb9c29ea599 |
| SHA1 | aeda7805291dca4b7fac211a623fd103e51f10ed |
| SHA256 | ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca |
| SHA512 | 0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e |
C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\lib\index.js
| MD5 | 553252424d89d17aade6a0bdab1f1c1d |
| SHA1 | 1cb30c6f75014eec81b10c27d51413a2f0fafadb |
| SHA256 | 89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f |
| SHA512 | 5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c |
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
| MD5 | f1f7369cd4f213cf2ae9469f4d1ef1f5 |
| SHA1 | cd7f1eb598f3ed855eb9033010dafc0198bf70c1 |
| SHA256 | 10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18 |
| SHA512 | 54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e |
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
| MD5 | 682f4e0c0c97dc90ec15872f8a032fae |
| SHA1 | f421835a7947e2576b56e55807f3513092a5a25a |
| SHA256 | dc7c2a0407a06266ad35e8b397204eaff78d0093d433beb5869910e9ad84e045 |
| SHA512 | dd697d1c3ae4e809d49b4993bb4c16eb4d765c50e7b63dc281497a8d363abdc7408411aab08c4c4f5393a8d88de6603bf87dec8b507f65f2bc6adc12afe5fcd0 |
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
| MD5 | 84b82e208b562cc8c5a48cf65e6ab0f0 |
| SHA1 | 0adca343dd729beb86ebbb103f9d84e7ebbd17af |
| SHA256 | 481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad |
| SHA512 | 377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5 |
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
| MD5 | 4c2c09e9ab99ed40fca6d6e2db3eebeb |
| SHA1 | 3447839a8d7778f8368309069c5c84be5509a522 |
| SHA256 | 92624213e6ce473a830dc8afb9592384bf50973882947ddabf5e79d13e2855a7 |
| SHA512 | 4a502f929e0e935a6f46c533ae70dbc744289e5ce7fc647d9fe761192a66e478df3c22cc4794855b7049ac113981e2c8552cd9c83b7ef0ad84b8ae2cc4db9ea0 |
C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
| MD5 | aaf4d3f519676aa3f490218a47fa6042 |
| SHA1 | 9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753 |
| SHA256 | f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c |
| SHA512 | 4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085 |
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
| MD5 | 0dd63ef9ebbb7c6f5a20aaba3d799be6 |
| SHA1 | bd7d41bbdf8dce506c049cdcb339c6015fb11290 |
| SHA256 | 6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5 |
| SHA512 | b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb |
C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
| MD5 | 63f87fc2f478d2edc530f3526eb84edf |
| SHA1 | 39280d15f6fa953ce90bc9cf4a55631908499020 |
| SHA256 | be34765b79562f51f8d7a7587906948a8bbfbf222ad2ad34e9950472530ee82b |
| SHA512 | b1d544ed04bea7f9970f808d512d06b901ec3d3c17ea30ac5f192da9bfae6496da4da349016b29f97f37d70e8547297233d80d9c01cba08c9cabdecf2557480d |
C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\60bc20bf
| MD5 | 3bcba958c6b6f93281ecae10d9487373 |
| SHA1 | d8215f38b885ddd8635c0ea338210f068e4781ee |
| SHA256 | 3936cd62847ce2f4e3cc2ab3633de5d02f02fbcf204fd52c03bd7ee7db55e169 |
| SHA512 | febf37c6c84f2c2c3138c50cc21580fffef19f2fe554145712c8f5f8a02827c48268a23fbeeebc48224571c46505484e0ae44924f614d416d691ba1004feb007 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | faf4c2fdcd613a16ebcfba47de8ba58e |
| SHA1 | 1fac76787a38f882047d26848458de16be18cd5d |
| SHA256 | 0ab4ea5c6fc308bf115769ce56a4d26a58108fa508ed5d9d7466d19333f181ef |
| SHA512 | 8d88a8a4457e17ff6bf87d256b92d35037c8e08365d1b9b2d8308def11fb89a57046faf78bd9c3538bdeeb19e4e780230d9571155946ec092d95f35ccaf7c227 |
C:\Users\Admin\AppData\Local\Temp\p\node_modules\once\LICENSE
| MD5 | 82703a69f6d7411dde679954c2fd9dca |
| SHA1 | bb408e929caeb1731945b2ba54bc337edb87cc66 |
| SHA256 | 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b |
| SHA512 | 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
| MD5 | c3c0eb5e044497577bec91b5970f6d30 |
| SHA1 | d833f81cf21f68d43ba64a6c28892945adc317a6 |
| SHA256 | eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb |
| SHA512 | 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
| MD5 | 76a3f1e9a452564e0f8dce6c0ee111e8 |
| SHA1 | 11c3d925cbc1a52d53584fd8606f8f713aa59114 |
| SHA256 | 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c |
| SHA512 | a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
| MD5 | 710d7637cc7e21b62fd3efe6aba1fd27 |
| SHA1 | 8645d6b137064c7b38e10c736724e17787db6cf3 |
| SHA256 | c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b |
| SHA512 | 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
| MD5 | 929b1f88aa0b766609e4ca5b9770dc24 |
| SHA1 | c1f16f77e4f4aecc80dadd25ea15ed10936cc901 |
| SHA256 | 965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074 |
| SHA512 | fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7e47622139ea3eef79d20393de7b595e |
| SHA1 | bc9522be4882d697ca89344dc9ec41ddf748303c |
| SHA256 | 1c3c6a5ed4d13b355322f90e7e1674e17ba3112396fb8fd5fd040e8a2c4764f7 |
| SHA512 | ad4afdd59863b1f655acdca328f0f5dcff9190254c931b76d2c3cdbb4fe4859c469551b6156984b5d1900e5bc2ad12edd29d056a10e15204f0cb9e6e680e59d3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 9b41edb8df0fbffb6d73ad1e9ef125c1 |
| SHA1 | bf6330a8b823087eb149b86220ee8f79ed493a5c |
| SHA256 | 0c52499cb47f20be040e9b99f65a49219dcbd6bac87a1abb348f2e217dbca982 |
| SHA512 | e5fafe8d6e592164b8ebcf85d7c80b7f20ebb67d664931df8186eab49a0164f05115460af6482436e531c299d4b942e9538941240cab45044b8af7f4f0314471 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c6fdebf7b17550d346966a30344e0a00 |
| SHA1 | 24e16d7a8af680df92815999d07c3747c28d58f3 |
| SHA256 | 1b9e8dd1ad9bcd94b8716e0995d4cb6d52383a77ab14a1c91e880bed79b9830b |
| SHA512 | 2ae8d1977065d6c1c2f196231cc0f177d5717a95e4787c7d411df5b5a7ba604992f01ed6bfea225023181e4ea88fdaca1ab5585f78c2a5f28886020d3b90f476 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e48eedff8baae84f3d70a2128955bca3 |
| SHA1 | b7069e3b3d7104e5bcf69320bb5a7d9fec290349 |
| SHA256 | 8ea79871b92596e886b563f8362293b165bdd98d8d8ebf30cfdab8d474caaf56 |
| SHA512 | e96e6c4ce916ba108ef7dd3533fd27fde9aadd13124c736ecfff8b38f450786f80f19aa92a51759bed0832391c8266694c33211349110ac0ad046f6c7c98d25e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | d50ffa11db5fe805270d85123cde7283 |
| SHA1 | 5ac9bc284d0338150fcaf07b18569202633e9ae1 |
| SHA256 | c7571abf894406d26d23dac6afcc43f63b43f351a391ed7c420febd91bbdf426 |
| SHA512 | 149eaacf99b5b89be4ae1c2cac93dfefc21decda06d2469fceccc531d79d2cbf1d74845e74f5b0ec757422c8a1370e1c2fdfdf34934d810e95b4cb4545dc3222 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 6743c9db8be37abb3d1648696159c96c |
| SHA1 | d920afbbd3c12dc2dac7c9e4fd29d52f9dc4bd23 |
| SHA256 | 846e00e9bcd38f7f6e39af7f6ba921187430fae9f56d97e7ae7b39daf19df834 |
| SHA512 | 3f09dfa7e526c61e284895f942c754fbb2609fcbafd5f15016bf54bede52e3aa8b272857266716cf60e8117c47a70d213779180d6df7c4629c9ae1e27c84171a |