xworm | hxxp://nodejs[.]org

Analysis

max time kernel
329s
max time network
337s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://nodejs.org

Score

10^/10

xworm defense_evasion discovery execution rat trojan

Malware Config

Extracted

Family

xworm

man-laughing.gl.at.ply.gg:57783

Attributes

Install_directory
%LocalAppData%
install_file
Windows Data Compiler.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/876-2953-0x0000000000890000-0x00000000008A8000-memory.dmp	family_xworm
behavioral1/files/0x000b0000000249a5-2997.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4320	powershell.exe
2608	powershell.exe
4368	powershell.exe
1948	powershell.exe
4564	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	node.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
3224	node.exe
1968	node.exe
4304	node.exe
876	cmd.exe
408	node.exe
1884	node.exe

Loads dropped DLL 7 IoCs

pid	Process
4408	MsiExec.exe
4408	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
1556	MsiExec.exe
4512	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2380	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
82	ip-api.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\node_modules\universalify\index.js	node.exe
File created	C:\Windows\system32\node_modules\webidl-conversions\lib\index.js	node.exe
File created	C:\Windows\system32\node_modules\jsonfile\CHANGELOG.md	node.exe
File created	C:\Windows\system32\node_modules\tr46\lib\.gitkeep	node.exe
File created	C:\Windows\system32\node_modules\jsonfile\index.js	node.exe
File created	C:\Windows\system32\node_modules\graceful-fs\graceful-fs.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\remove\index.js	node.exe
File created	C:\Windows\system32\node_modules\webidl-conversions\README.md	node.exe
File created	C:\Windows\system32\node_modules\node-fetch\lib\index.es.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\json\jsonfile.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\mkdirs\utils.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\util\utimes.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\copy\copy-sync.js	node.exe
File created	C:\Windows\system32\node_modules\node-fetch\browser.js	node.exe
File created	C:\Windows\system32\node_modules\graceful-fs\legacy-streams.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\empty\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\mkdirs\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\symlink-paths.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\symlink.js	node.exe
File created	C:\Windows\system32\node_modules\universalify\LICENSE	node.exe
File created	C:\Windows\system32\node_modules\webidl-conversions\LICENSE.md	node.exe
File created	C:\Windows\system32\node_modules\whatwg-url\README.md	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\json\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\path-exists\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\symlink-type.js	node.exe
File opened for modification	C:\Windows\system32\node_modules\.bin\fixsolara.ps1	node.exe
File created	C:\Windows\system32\node_modules\.bin\fixsolara.cmd	node.exe
File created	C:\Windows\system32\node_modules\jsonfile\package.json	node.exe
File created	C:\Windows\system32\node_modules\whatwg-url\lib\utils.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\LICENSE	node.exe
File created	C:\Windows\system32\node_modules\graceful-fs\LICENSE	node.exe
File created	C:\Windows\system32\node_modules\graceful-fs\clone.js	node.exe
File created	C:\Windows\system32\node_modules\tr46\.npmignore	node.exe
File created	C:\Windows\system32\node_modules\jsonfile\LICENSE	node.exe
File created	C:\Windows\system32\node_modules\whatwg-url\lib\url-state-machine.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\LICENSE	node.exe
File created	C:\Windows\system32\node_modules\tr46\index.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\README.md	node.exe
File created	C:\Windows\system32\node_modules\universalify\package.json	node.exe
File created	C:\Windows\system32\node_modules\node-fetch\lib\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\util\stat.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\README.md	node.exe
File created	C:\Windows\system32\node_modules\jsonfile\utils.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\index.d.ts	node.exe
File created	C:\Windows\system32\node_modules\fixsolara\package.json	node.exe
File created	C:\Windows\system32\node_modules\node-fetch\lib\index.mjs	node.exe
File opened for modification	C:\Windows\system32\node_modules\fixsolara\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\copy\copy.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\file.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\copy\index.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\package.json	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\CHANGELOG.md	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\move\index.js	node.exe
File created	C:\Windows\system32\node_modules\node-fetch\package.json	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\link.js	node.exe
File created	C:\Windows\system32\node_modules\universalify\README.md	node.exe
File created	C:\Windows\system32\node_modules\whatwg-url\lib\URL-impl.js	node.exe
File created	C:\Windows\system32\node_modules\sudo-prompt\test-concurrent.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\ensure\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\fs\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\output-file\index.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\move\move.js	node.exe
File created	C:\Windows\system32\node_modules\fs-extra\lib\json\output-json-sync.js	node.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cmd-shim\lib\to-batch-syntax.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\dbcs-data.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\agent\lib\proxy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\ipv4.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\response.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\cmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npx	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\timestamp\set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\sortAscending.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\corepack.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\lifecycle-cmd.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\types.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\cjs\src\bin.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\normalize-windows-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-version.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\display.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\isexe\dist\cjs\posix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\path-arg.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\unique-slug\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\migratingFromV1.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\pseudo.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\examples\ordered-options.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\typescript\associateExample.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\npmrc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\xcode_test.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_parser.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\processor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\fix-eperm.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-init.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\npm-global.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\util\glob.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-logout.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\fs-minipass\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_trustroot.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-loose.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-repo.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-pkg.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\package-json-from-dist\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\rimraf-native.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\mjs\mkdirp-manual.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\install.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\cmd-list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\scope.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\path-arg.js	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59ec8b.msi	msiexec.exe
File created	C:\Windows\Installer\e59ec89.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE0F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CC2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ec89.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEECC.tmp	msiexec.exe
File created	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI309C.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\DocumentationShortcuts	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\npm	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\PackageName = "node-v22.11.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\PackageCode = "7ADA4E96FE88DF64FB4F54512750A882"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Version = "369819648"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductIcon = "C:\\Windows\\Installer\\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 969523.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3576	msedge.exe
3576	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
1036	msedge.exe
1036	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
4496	msiexec.exe
4496	msiexec.exe
1968	node.exe
1968	node.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe
2608	powershell.exe
2608	powershell.exe
2608	powershell.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe
876	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2896	msiexec.exe
Token: SeSecurityPrivilege	4496	msiexec.exe
Token: SeCreateTokenPrivilege	2896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2896	msiexec.exe
Token: SeLockMemoryPrivilege	2896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2896	msiexec.exe
Token: SeMachineAccountPrivilege	2896	msiexec.exe
Token: SeTcbPrivilege	2896	msiexec.exe
Token: SeSecurityPrivilege	2896	msiexec.exe
Token: SeTakeOwnershipPrivilege	2896	msiexec.exe
Token: SeLoadDriverPrivilege	2896	msiexec.exe
Token: SeSystemProfilePrivilege	2896	msiexec.exe
Token: SeSystemtimePrivilege	2896	msiexec.exe
Token: SeProfSingleProcessPrivilege	2896	msiexec.exe
Token: SeIncBasePriorityPrivilege	2896	msiexec.exe
Token: SeCreatePagefilePrivilege	2896	msiexec.exe
Token: SeCreatePermanentPrivilege	2896	msiexec.exe
Token: SeBackupPrivilege	2896	msiexec.exe
Token: SeRestorePrivilege	2896	msiexec.exe
Token: SeShutdownPrivilege	2896	msiexec.exe
Token: SeDebugPrivilege	2896	msiexec.exe
Token: SeAuditPrivilege	2896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2896	msiexec.exe
Token: SeChangeNotifyPrivilege	2896	msiexec.exe
Token: SeRemoteShutdownPrivilege	2896	msiexec.exe
Token: SeUndockPrivilege	2896	msiexec.exe
Token: SeSyncAgentPrivilege	2896	msiexec.exe
Token: SeEnableDelegationPrivilege	2896	msiexec.exe
Token: SeManageVolumePrivilege	2896	msiexec.exe
Token: SeImpersonatePrivilege	2896	msiexec.exe
Token: SeCreateGlobalPrivilege	2896	msiexec.exe
Token: SeCreateTokenPrivilege	2896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2896	msiexec.exe
Token: SeLockMemoryPrivilege	2896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2896	msiexec.exe
Token: SeMachineAccountPrivilege	2896	msiexec.exe
Token: SeTcbPrivilege	2896	msiexec.exe
Token: SeSecurityPrivilege	2896	msiexec.exe
Token: SeTakeOwnershipPrivilege	2896	msiexec.exe
Token: SeLoadDriverPrivilege	2896	msiexec.exe
Token: SeSystemProfilePrivilege	2896	msiexec.exe
Token: SeSystemtimePrivilege	2896	msiexec.exe
Token: SeProfSingleProcessPrivilege	2896	msiexec.exe
Token: SeIncBasePriorityPrivilege	2896	msiexec.exe
Token: SeCreatePagefilePrivilege	2896	msiexec.exe
Token: SeCreatePermanentPrivilege	2896	msiexec.exe
Token: SeBackupPrivilege	2896	msiexec.exe
Token: SeRestorePrivilege	2896	msiexec.exe
Token: SeShutdownPrivilege	2896	msiexec.exe
Token: SeDebugPrivilege	2896	msiexec.exe
Token: SeAuditPrivilege	2896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2896	msiexec.exe
Token: SeChangeNotifyPrivilege	2896	msiexec.exe
Token: SeRemoteShutdownPrivilege	2896	msiexec.exe
Token: SeUndockPrivilege	2896	msiexec.exe
Token: SeSyncAgentPrivilege	2896	msiexec.exe
Token: SeEnableDelegationPrivilege	2896	msiexec.exe
Token: SeManageVolumePrivilege	2896	msiexec.exe
Token: SeImpersonatePrivilege	2896	msiexec.exe
Token: SeCreateGlobalPrivilege	2896	msiexec.exe
Token: SeCreateTokenPrivilege	2896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2896	msiexec.exe
Token: SeLockMemoryPrivilege	2896	msiexec.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
2896	msiexec.exe
2896	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
4740	OpenWith.exe
876	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4940	3576	msedge.exe	83
PID 3576 wrote to memory of 4940	3576	msedge.exe	83
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 4804	3576	msedge.exe	84
PID 3576 wrote to memory of 3724	3576	msedge.exe	85
PID 3576 wrote to memory of 3724	3576	msedge.exe	85
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86
PID 3576 wrote to memory of 4404	3576	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://nodejs.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9396046f8,0x7ff939604708,0x7ff939604718
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v22.11.0-x64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11462915890724418638,6871672224754164670,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6557B7D3A5343D691A4566D85BCA5DC8 C
  2⤵
  - Loads dropped DLL
  PID:4408
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3604
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 16D0BAAFB41C99B0641A3E81A40785BB
  2⤵
  - Loads dropped DLL
  PID:3564
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1A1A2A27F85E78B2CEC66FC2678F4071 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B30C6AC99268ECC7C57B61AAB9A613B6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  PID:2720
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:3224
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i fixsolara
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c node index.js
    3⤵
    PID:4520
  - - C:\Program Files\nodejs\node.exe
      node index.js
      4⤵
      Executes dropped EXE
      PID:4304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\1a91e27d3c78bbc6da85e3608681d0af\execute.bat'" -WindowStyle hidden -Verb runAs"
        5⤵
        Hide Artifacts: Hidden Window
        
        PID:2380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\1a91e27d3c78bbc6da85e3608681d0af\execute.bat'" -WindowStyle hidden -Verb runAs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1a91e27d3c78bbc6da85e3608681d0af\execute.bat"
        7⤵
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\cmd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
        8⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cmd.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Data Compiler.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Data Compiler.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  PID:8
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:408
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i solarafix
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59ec8a.rbs

Filesize
935KB

MD5
01c097080ac78a33750d8f84efb43479

SHA1
a9e504a5f02d2c409420a18318f1e3bc2cf7d6e8

SHA256
a83adf2543dde69a5e9ecfeb559dd487fe2bc961a1762d0ec1b435ab790de681

SHA512
18ab1a21ae345a7f402c53b73434367d29a148b6317b68d8760ebcb83dd9b167be27bf34051d0688a64147c33e98b5d174570b6864abb99badddfe41f6dd76a4

Download Submit
C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js

Filesize
864B

MD5
92dd1b5a463374142271ff420cb473a5

SHA1
a9f946c6a8c6f273f837703acc74c367b7781a99

SHA256
673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e

SHA512
5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js

Filesize
29KB

MD5
a2819bc319ade96e220b81c11ba1fd62

SHA1
f711920489d12ac7704e323de4cea98009299e7d

SHA256
9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e

SHA512
64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js

Filesize
1KB

MD5
8385a8a608e5cdd5a79957a6c979fb28

SHA1
d20fd55ae3664cd339245fdd26a28983baf97f2e

SHA256
5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648

SHA512
3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js

Filesize
949B

MD5
ae8c8f3d710c2c7a5cacbcef9c6f9646

SHA1
3fabbd5fcbeca40267f54aa7f523afa573062ad3

SHA256
9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68

SHA512
94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json

Filesize
1KB

MD5
901e577d669d97e811a11f172dfb6655

SHA1
25d518b50deb389e311821d64d4b0b106618d7c7

SHA256
245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5

SHA512
ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE

Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js

Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license

Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json

Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json

Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js

Filesize
7KB

MD5
84b82e208b562cc8c5a48cf65e6ab0f0

SHA1
0adca343dd729beb86ebbb103f9d84e7ebbd17af

SHA256
481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad

SHA512
377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json

Filesize
1KB

MD5
5b29ab3cad80b08ec094c8201333ebe8

SHA1
dee99f05b24963959159f1f061926e9075679be8

SHA256
94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867

SHA512
a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js

Filesize
186B

MD5
1d97bc3d56be902d4f63b37b05f3ad85

SHA1
ace1fd823fc44e12a25448db2b5a49e20973e506

SHA256
0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46

SHA512
fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js

Filesize
12KB

MD5
94443c174d88f844a9ccc4b910f630cc

SHA1
fcb80696d47cad01738194971bc75c5e249044ce

SHA256
ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56

SHA512
1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js

Filesize
985B

MD5
f1f7369cd4f213cf2ae9469f4d1ef1f5

SHA1
cd7f1eb598f3ed855eb9033010dafc0198bf70c1

SHA256
10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18

SHA512
54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js

Filesize
2KB

MD5
0dd63ef9ebbb7c6f5a20aaba3d799be6

SHA1
bd7d41bbdf8dce506c049cdcb339c6015fb11290

SHA256
6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5

SHA512
b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js

Filesize
1KB

MD5
553252424d89d17aade6a0bdab1f1c1d

SHA1
1cb30c6f75014eec81b10c27d51413a2f0fafadb

SHA256
89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f

SHA512
5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json

Filesize
1KB

MD5
aa721fce40b4331d0ded9cb9c29ea599

SHA1
aeda7805291dca4b7fac211a623fd103e51f10ed

SHA256
ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca

SHA512
0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json

Filesize
1KB

MD5
80bdf8901061eac24047d6b001499e89

SHA1
a99d447473406d5e862ae9337b7aee363a8d2f13

SHA256
8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c

SHA512
b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js

Filesize
3KB

MD5
aaf4d3f519676aa3f490218a47fa6042

SHA1
9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753

SHA256
f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c

SHA512
4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json

Filesize
1KB

MD5
b9eb984a5b149084bb675358404d83ee

SHA1
2c87199e46d74c4de3202607efde64947bdc250b

SHA256
25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380

SHA512
4f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js

Filesize
8KB

MD5
f745bb0f4002c0aa36126e746de7b42e

SHA1
e457241c0a0e36daf5be5a1378bf54f992d08408

SHA256
9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3

SHA512
42d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js

Filesize
333B

MD5
4bb860ccb55a8e7f8e15094c423bf190

SHA1
337cbb70f03b1e4a6128670ae8687cb4e2c337b5

SHA256
af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962

SHA512
0c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js

Filesize
168B

MD5
fc7283ee28a91d78c8e336e34115a423

SHA1
bc78998bd04ce27fd79dd5585ea9d9858fb929cb

SHA256
cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8

SHA512
1e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json

Filesize
1KB

MD5
908ee832e1efb27e9faa3318cbc40675

SHA1
f48baa57e29980f9602f30351fd68ba2da243ce9

SHA256
a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019

SHA512
310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE

Filesize
757B

MD5
8bb6f78000746d4fa0baf4bdbf9e814e

SHA1
4b7049331119a63009aec376677b97c688266613

SHA256
a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

SHA512
ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js

Filesize
474B

MD5
54bd6e9d21ed6021e374d34cfaa3290c

SHA1
e71ef5c7bf958f1599fce51cc98a73f849659380

SHA256
4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036

SHA512
7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json

Filesize
1KB

MD5
e6b2ad09f00a37da8012022f4b9e0461

SHA1
9af557e76ab4036536d792ca9b3c37d4720c0587

SHA256
2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4

SHA512
9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\Program Files\nodejs\node_modules\npm\package.json

Filesize
6KB

MD5
a635c09a3ba36d76e04158ba070c32e2

SHA1
6bdda03a1e34946e25fced365eb9da0df97e9e29

SHA256
6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446

SHA512
cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818

Download Submit
C:\Program Files\nodejs\npm.cmd

Filesize
538B

MD5
6895fc6423c97fbf721a71333137d1ca

SHA1
e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e

SHA256
21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8

SHA512
0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
72b8c907a5d50eb4917010e78ef8a23b

SHA1
a3e7ebff0927ae76cecdedb6e81422be78786bd3

SHA256
f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20

SHA512
9def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
eef4d122f8bf1654f2fa39587b4bc772

SHA1
44a154a863d3284a00dd52881534b35d0eedd6d0

SHA256
90dfae0c893bcfeca726e1c5ee01121213f1bf56f365ebcd24f8a2173b6b06d6

SHA512
27402871d4e035000ac1b9259d9631cc30815fe1982f6b2d2c1d6db082e2496f8d55547f65bb2dbfd77b3521fd66fc438bed7ddc5efe90e9914cdee5e2eeb4d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
727B

MD5
21fa5777ea4ab164dae993a4b0bf6d72

SHA1
7208c8c8b18869ee177a2ccf891f1cb55fe2ea27

SHA256
a1bd67880fae968a874e4d7598edccde074fb3e75a1f44c3583cf19e379bf467

SHA512
7f1f193e41d23821272697a181c5c253c0de628150ba324e964f90ae23f1ead09b77344f9de3cec096019347bce2fd5b4f15bf1d580aef8a3c0f2998d8dff0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
397ff398089ad38f837ed86c42e78205

SHA1
8aeb6f8664552b8486b41cbf7546219c5fc5e7d7

SHA256
712f75d7057e41be9228c2c7267c39993f3bd618b468d1e44c233bbe76cfed1d

SHA512
3ac2414e49638504a079a4e2b6ea08441fed868d1c3a3c0ae3ee99e64c6c61f03118483609751dab9da3ff5d7fa08c887661205017afd6e011d433bcbd26d0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
4e5841690035fda69cb863b7fe7e6ca5

SHA1
2798210f9a1bc78dba98e5bc0df7144e375e95a2

SHA256
bf568030e56d465dbccb86e706ce19d6569bd5840153f65c634f6cd34da18dd7

SHA512
934e95d2b889e08ec8fb4eb8ad65253a2098d02f473a440255f3fa1b580b8d00045b8f580e1603e03c135ce4466bbed03af20661388299a1f7ab30231fad7852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
404B

MD5
76067486da1650dab1fd853be27beff1

SHA1
09b7a955a1577263313ab2dc6786f1f2f6c07bd5

SHA256
d7108dbcfefdd31c7f534da4039f0f6b733679dda49e4e58e06f43c4a7a972f3

SHA512
75f8d06e59255e54e9d84806c1b03d7cbe9f6ac0b0d208bfa672ba9db4d67ccf591ae1f3686ee1163ab4c353b984f78581213f07b422fdc997c56e2f4cb55733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
cb656ee195ee5c4c90a51141c0584638

SHA1
010dae7713c07000b28eef620405d0865071e6df

SHA256
44f3663d202e8e74b329c582d0725ef9310bf1404e82ab579497adb312040eeb

SHA512
eae681cefe7d4143119aa5c0e82fce272fd6fa04063400c6b3cfc8c03fac9f35fd99f9e7cee63fe10517e3fc5c59cb0d78dc8ff8c72f204f831b062c633a91a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
1b159c4d55e7592ac30a5cb560b14496

SHA1
15a8a2a310c70e660974623ce053d7336cd24b97

SHA256
caf4959b7410422ff3f74f7a8d47736dafa2a39c08adf00e0e1150aa68988cfd

SHA512
007feb8133850f04680e83945858cbf1087f21f4389cf4e817e5d50786389228a1bafec1ce52a68119eddfa869f6614c2f8aba1a430ad353d958b414d1ed39da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
251B

MD5
e9290feaa17eb5dab0633153bf11802b

SHA1
1d59f60548c2cd9183aa3361f0b97003812c4942

SHA256
fc1c33415e87f34cd61da02177cacd32ac81ed80182a2922f22ffc63bc39c241

SHA512
3e55911f0600d4cd361252eba21843ee2c3b8b4944c1ad89b19a7cbaa31d3b9c20dd46824a59ea75d902f2d5c0f0bb828767c2d5acc4c029a2e8506ec5e04b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4b930df4f33c5a58f5e0aa70f0977aa

SHA1
2142273ae7f7f4818278be7e45bec5df94971cf3

SHA256
d5a0e443af3a3b621c82b26385b9778142c6b6b9e0c602dadca39ad71eeaa7b2

SHA512
a8814207cc4dc30b9971556fc90984642ac85fc5b89ced1e548b8dbd51e490a2b0dd379dd1c44dc416ab057d9653e2b8aed35c359263d74f85f7ece6c0d5db99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec9e10dd9a620af9e1739bd189b91976

SHA1
c6fee16c5a261936e5a986db98728affcb29c4cd

SHA256
8b86e59a4c0dd100757964577851e3920a7421836ac9dd019c9f43c7f6252952

SHA512
f6588727728b7070bad4286a278a14131016d3140d566c6127d184d48a719bbffee5c72b3629e5291797608154126cdb6301cdbf42d151ce6c8eb26ecaecec65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3aeaf7bd5561d02deec3ea88fe51416d

SHA1
db636d889ce1ff849144963a5604865ef299352b

SHA256
31dd8bc78f5568d027c95be03db4e4edf351eea06057cce7e19cb05e4e01fc98

SHA512
4022e84f548073959dc234694c56e9f4f0b6c62730e7dc69cb2a213855b3a261de29029a57c99405e4199730b6613924a2ca3a95851c3b9f74358622672ddf19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aec9b4b5c9270b82cdd9497ddd111c86

SHA1
7d512bc05f09e45cf85560264a016766c2ee9bc2

SHA256
60465b0cc92ede0e6ac276fd98f92f8d73ea2621c8afe9114d866820c06782b4

SHA512
5980ecc6040eafb6df674fdb78a6c0c987575adb9f7e63b92ed589d529849506bf2801dd23d028b1f4abd22f2a07ecb8e4e0f2133e52c13575bd60cbd471990b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd1e26e0-db04-40aa-817d-75a902cd0b2f.tmp

Filesize
10KB

MD5
f0da79b12b7825ad9c5b16130d04ff91

SHA1
4665239737db9471c31e6637491c3894ad4375a7

SHA256
7974562c5b6718930f7abb88fb0ac86e72f7d18cf646a699c3ebf7c6df436dce

SHA512
462b16637bec0c7e96e539acb267afac87f009af9d0be1d1d4de5be9023a99809d6887de6734a77770b1b8d7c2b16e2e76878c287ade42741145d8421ca18233

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI51C5.tmp

Filesize
144KB

MD5
7fa9d662d634534d7c2240dd126bdeee

SHA1
bd01e22ed2da0d0d485824b372ac67da683863d2

SHA256
c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

SHA512
cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI539A.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upxt0kt2.f1w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Windows Data Compiler.exe

Filesize
73KB

MD5
4d06f782ea4baaa7e29f2c5f51881424

SHA1
05f011ea63cd2a858a810d1c4af731dd62e25475

SHA256
3c3d3296877df802b4f277b3ced693150e9f8277b99e24efbbc972518da25cc5

SHA512
1da805173099e7067b7be97d4189b542a61b6eab8ac7d24df638f71a8e6d18a133a5f8ad6bc4c912e06ad64c2852be9bdbfa14ac82870b5adfd786385f99423d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 969523.crdownload

Filesize
28.9MB

MD5
fa9e1f3064a66913362e9bff7097cef5

SHA1
b34f1f9a9f6242c54486a4bc453a9336840b4425

SHA256
9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

SHA512
ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

Download Submit
C:\Windows\Installer\MSI309C.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
f4c09cd3e34326bd8383eb9e1874699d

SHA1
d056b498d7c32b8ccf5442c43f4c06875829b8d1

SHA256
0f0d8e562f53edc8ca5ed5a9e364bdf777972a6dc66c6ca58798cc9238b554d9

SHA512
90c548457f3b93a9b7580cc01523c869f2e3c929a2e925a43a07b6f337798df8f49368f3f0f11a72f029288d40641b45c2a15c758cd3806ab212ce0247482503

Download Submit
\??\Volume{f9c79713-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d9522d55-d9fa-4b16-a37c-fc77f5c327a8}_OnDiskSnapshotProp

Filesize
6KB

MD5
c851d8bba49b821a74e02d23bfe100cd

SHA1
1c5ae10d55bbdf73407cab25c6dd6a71cfafe90f

SHA256
05132d2e27ba38ae91aff267c2e589b8cec435855774fb51151be2b170a8fcb7

SHA512
40dbbf849efc1f7b8311f94b6f730da7dd0e94ad5a26c5466618fc1283366f5233dc9f878d9f6b08074bbb1dbd25434d07ead2024aed7b9beb87560ba6f0c17c

Download Submit
memory/876-2953-0x0000000000890000-0x00000000008A8000-memory.dmp

Filesize
96KB

Download
memory/4320-2940-0x000001B4311D0000-0x000001B4311F2000-memory.dmp

Filesize
136KB

Download
memory/4496-257-0x0000019AC7EA0000-0x0000019AC8961000-memory.dmp

Filesize
10.8MB

Download