Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2024, 18:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nodejs.org
Resource
win10v2004-20241007-en
General
-
Target
http://nodejs.org
Malware Config
Extracted
xworm
completed-rally.gl.at.ply.gg:28996
-
Install_directory
%LocalAppData%
-
install_file
Windows Data Compiler.exe
Extracted
xworm
5.0
shoes-since.gl.at.ply.gg:49960
george-liechtenstein.gl.at.ply.gg:2030
XnVPNFvj6qHEv6EY
-
Install_directory
%AppData%
-
install_file
WindowsAntivirus.exe
Signatures
-
Detect Xworm Payload 6 IoCs
resource yara_rule behavioral1/files/0x001600000002398b-2944.dat family_xworm behavioral1/memory/4268-2950-0x0000000000F70000-0x0000000000F88000-memory.dmp family_xworm behavioral1/files/0x0008000000024a04-2965.dat family_xworm behavioral1/memory/5260-2970-0x0000000000DF0000-0x0000000000E00000-memory.dmp family_xworm behavioral1/files/0x000400000001e5b1-2985.dat family_xworm behavioral1/memory/5528-2992-0x00000000002C0000-0x00000000002D2000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5724 powershell.exe 5512 powershell.exe 5736 powershell.exe 5976 powershell.exe 2468 powershell.exe 6036 powershell.exe 5272 powershell.exe 5956 powershell.exe 6004 powershell.exe 3000 powershell.exe 5380 powershell.exe 3308 powershell.exe 912 powershell.exe 4368 powershell.exe 4836 powershell.exe 3856 powershell.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation node.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation XClient.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Bootstrapper (1).exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Windows Defender.exe -
Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk XClient.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAntivirus.lnk Bootstrapper (1).exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAntivirus.lnk Bootstrapper (1).exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk Windows Defender.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk XClient.exe -
Executes dropped EXE 7 IoCs
pid Process 2304 node.exe 4000 node.exe 1560 node.exe 3308 cmd.exe 4268 XClient.exe 5260 Bootstrapper (1).exe 5528 Windows Defender.exe -
Loads dropped DLL 7 IoCs
pid Process 2476 MsiExec.exe 2476 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 1480 MsiExec.exe 2064 MsiExec.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsAntivirus = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsAntivirus.exe" Bootstrapper (1).exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe" Windows Defender.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Windows\\System32\\XClient.exe" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bootstrapper (1) = "C:\\Windows\\System32\\Bootstrapper (1).exe" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Windows\\System32\\Windows Defender.exe" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Data Compiler = "C:\\Users\\Admin\\AppData\\Local\\Windows Data Compiler.exe" XClient.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 2372 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 83 ip-api.com -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\System32\XClient.exe cmd.exe File opened for modification C:\Windows\System32\XClient.exe cmd.exe File created C:\Windows\System32\Bootstrapper (1).exe cmd.exe File created C:\Windows\System32\Windows Defender.exe cmd.exe File opened for modification C:\Windows\System32\Windows Defender.exe cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-completion.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-fund.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\completion.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_trustroot.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\ignore-enoent.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\corepack.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\body.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-find-dupes.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\internal\errors.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\commonjs\symlink-error.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\create.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\get-bin-from-manifest.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\shrinkwrap.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\json.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common_test.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\registry.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\fix-eperm.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sprintf-js\dist\angular-sprintf.min.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\agent\lib\agents.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\link-mans.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\glob.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\rimraf-manual.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\make-fetch-happen\lib\cache\key.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-help-search.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\polyfill.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\lib\debug.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-convert\route.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic2.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\dist\esm\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\strip-trailing-slashes.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\restart.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\strip-ansi\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\commonjs\parse.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\ignore-enoent.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\license msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\update.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\large-numbers.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\org.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\agent\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-loose.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\yarn-lock.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\err-code\index.umd.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf32.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\package.json msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82} msiexec.exe File opened for modification C:\Windows\Installer\MSI9FC.tmp msiexec.exe File created C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon msiexec.exe File created C:\Windows\Installer\e58fbc2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI47B3.tmp msiexec.exe File created C:\Windows\Installer\e58fbc0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIFD18.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\e58fbc0.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4485.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD86.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI642.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e6cf55ff94a5976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e6cf55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e6cf55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de6cf55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6cf55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\PackageName = "node-v22.11.0-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\corepack msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPath msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\PackageCode = "7ADA4E96FE88DF64FB4F54512750A882" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Version = "369819648" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductName = "Node.js" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductIcon = "C:\\Windows\\Installer\\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\\NodeIcon" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings powershell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\NodeRuntime msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\npm msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media msiexec.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 693871.crdownload:SmartScreen msedge.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2688 schtasks.exe 5188 schtasks.exe 5448 schtasks.exe 5496 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 972 msedge.exe 972 msedge.exe 828 msedge.exe 828 msedge.exe 1876 identity_helper.exe 1876 identity_helper.exe 4244 msedge.exe 4244 msedge.exe 3268 msiexec.exe 3268 msiexec.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 4000 node.exe 4000 node.exe 3856 powershell.exe 3856 powershell.exe 3856 powershell.exe 4368 powershell.exe 4368 powershell.exe 4368 powershell.exe 4836 powershell.exe 4836 powershell.exe 4836 powershell.exe 5272 powershell.exe 5272 powershell.exe 5272 powershell.exe 5724 powershell.exe 5724 powershell.exe 5724 powershell.exe 5956 powershell.exe 5956 powershell.exe 5956 powershell.exe 6004 powershell.exe 6004 powershell.exe 6004 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 5380 powershell.exe 5380 powershell.exe 5380 powershell.exe 5512 powershell.exe 5512 powershell.exe 5512 powershell.exe 3308 powershell.exe 3308 powershell.exe 3308 powershell.exe 2468 powershell.exe 2468 powershell.exe 2468 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 5736 powershell.exe 5736 powershell.exe 5736 powershell.exe 5976 powershell.exe 5976 powershell.exe 5976 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 32 msiexec.exe Token: SeIncreaseQuotaPrivilege 32 msiexec.exe Token: SeSecurityPrivilege 3268 msiexec.exe Token: SeCreateTokenPrivilege 32 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 32 msiexec.exe Token: SeLockMemoryPrivilege 32 msiexec.exe Token: SeIncreaseQuotaPrivilege 32 msiexec.exe Token: SeMachineAccountPrivilege 32 msiexec.exe Token: SeTcbPrivilege 32 msiexec.exe Token: SeSecurityPrivilege 32 msiexec.exe Token: SeTakeOwnershipPrivilege 32 msiexec.exe Token: SeLoadDriverPrivilege 32 msiexec.exe Token: SeSystemProfilePrivilege 32 msiexec.exe Token: SeSystemtimePrivilege 32 msiexec.exe Token: SeProfSingleProcessPrivilege 32 msiexec.exe Token: SeIncBasePriorityPrivilege 32 msiexec.exe Token: SeCreatePagefilePrivilege 32 msiexec.exe Token: SeCreatePermanentPrivilege 32 msiexec.exe Token: SeBackupPrivilege 32 msiexec.exe Token: SeRestorePrivilege 32 msiexec.exe Token: SeShutdownPrivilege 32 msiexec.exe Token: SeDebugPrivilege 32 msiexec.exe Token: SeAuditPrivilege 32 msiexec.exe Token: SeSystemEnvironmentPrivilege 32 msiexec.exe Token: SeChangeNotifyPrivilege 32 msiexec.exe Token: SeRemoteShutdownPrivilege 32 msiexec.exe Token: SeUndockPrivilege 32 msiexec.exe Token: SeSyncAgentPrivilege 32 msiexec.exe Token: SeEnableDelegationPrivilege 32 msiexec.exe Token: SeManageVolumePrivilege 32 msiexec.exe Token: SeImpersonatePrivilege 32 msiexec.exe Token: SeCreateGlobalPrivilege 32 msiexec.exe Token: SeCreateTokenPrivilege 32 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 32 msiexec.exe Token: SeLockMemoryPrivilege 32 msiexec.exe Token: SeIncreaseQuotaPrivilege 32 msiexec.exe Token: SeMachineAccountPrivilege 32 msiexec.exe Token: SeTcbPrivilege 32 msiexec.exe Token: SeSecurityPrivilege 32 msiexec.exe Token: SeTakeOwnershipPrivilege 32 msiexec.exe Token: SeLoadDriverPrivilege 32 msiexec.exe Token: SeSystemProfilePrivilege 32 msiexec.exe Token: SeSystemtimePrivilege 32 msiexec.exe Token: SeProfSingleProcessPrivilege 32 msiexec.exe Token: SeIncBasePriorityPrivilege 32 msiexec.exe Token: SeCreatePagefilePrivilege 32 msiexec.exe Token: SeCreatePermanentPrivilege 32 msiexec.exe Token: SeBackupPrivilege 32 msiexec.exe Token: SeRestorePrivilege 32 msiexec.exe Token: SeShutdownPrivilege 32 msiexec.exe Token: SeDebugPrivilege 32 msiexec.exe Token: SeAuditPrivilege 32 msiexec.exe Token: SeSystemEnvironmentPrivilege 32 msiexec.exe Token: SeChangeNotifyPrivilege 32 msiexec.exe Token: SeRemoteShutdownPrivilege 32 msiexec.exe Token: SeUndockPrivilege 32 msiexec.exe Token: SeSyncAgentPrivilege 32 msiexec.exe Token: SeEnableDelegationPrivilege 32 msiexec.exe Token: SeManageVolumePrivilege 32 msiexec.exe Token: SeImpersonatePrivilege 32 msiexec.exe Token: SeCreateGlobalPrivilege 32 msiexec.exe Token: SeCreateTokenPrivilege 32 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 32 msiexec.exe Token: SeLockMemoryPrivilege 32 msiexec.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 32 msiexec.exe 32 msiexec.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe 828 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4268 XClient.exe 5260 Bootstrapper (1).exe 5528 Windows Defender.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 828 wrote to memory of 940 828 msedge.exe 83 PID 828 wrote to memory of 940 828 msedge.exe 83 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 1504 828 msedge.exe 84 PID 828 wrote to memory of 972 828 msedge.exe 85 PID 828 wrote to memory of 972 828 msedge.exe 85 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 PID 828 wrote to memory of 1060 828 msedge.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://nodejs.org1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff869e46f8,0x7fff869e4708,0x7fff869e47182⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:12⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v22.11.0-x64.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:32
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3244
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 57B1215F3256C11C54FE2B60D592A0BF C2⤵
- Loads dropped DLL
PID:2476
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3604
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DD1BEBDD28C1EA8115005BAF1BDA934A2⤵
- Loads dropped DLL
PID:2328
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 273866B603360BA98EEF63D00D0225BF E Global\MSI00002⤵
- Loads dropped DLL
PID:1480
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 29AE06ED845E81A20B90495F8430F87B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4476
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4404
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:1448
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"2⤵PID:3480
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
- Executes dropped EXE
PID:2304
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rootkitfix2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4000 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node index.js3⤵PID:3356
-
C:\Program Files\nodejs\node.exenode index.js4⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat'" -WindowStyle hidden -Verb runAs"5⤵
- Hide Artifacts: Hidden Window
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat'" -WindowStyle hidden -Verb runAs6⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat"7⤵PID:4044
-
C:\Windows\system32\chcp.comchcp 650018⤵PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3308 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "XClient" /SC ONLOGON /TR "C:\Windows\System32\XClient.exe" /RL HIGHEST9⤵
- Scheduled Task/Job: Scheduled Task
PID:2688
-
-
C:\Windows\System32\XClient.exe"C:\Windows\System32\XClient.exe"9⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4268 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Data Compiler.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Data Compiler.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3308
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Data Compiler" /tr "C:\Users\Admin\AppData\Local\Windows Data Compiler.exe"10⤵
- Scheduled Task/Job: Scheduled Task
PID:5496
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Bootstrapper (1)" /SC ONLOGON /TR "C:\Windows\System32\Bootstrapper (1).exe" /RL HIGHEST9⤵
- Scheduled Task/Job: Scheduled Task
PID:5188
-
-
C:\Windows\System32\Bootstrapper (1).exe"C:\Windows\System32\Bootstrapper (1).exe"9⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5260 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Bootstrapper (1).exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsAntivirus.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsAntivirus.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5736
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5272
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Windows Defender" /SC ONLOGON /TR "C:\Windows\System32\Windows Defender.exe" /RL HIGHEST9⤵
- Scheduled Task/Job: Scheduled Task
PID:5448
-
-
C:\Windows\System32\Windows Defender.exe"C:\Windows\System32\Windows Defender.exe"9⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5528 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6036
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f""5⤵PID:5572
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
935KB
MD59b727a04a6164fb5d83a3190ec9eebbb
SHA1ec0a8419743af8931b6a0b682c3a9fa6425f1cf7
SHA256f17e2e55182cff9cbf4ccf0cda3e4e1c2dfc1219ed09dbcbeaffc4586bff5799
SHA512cf55cb3cb692400f3c51344ecd85367a91bd71e2a284ff7f39c7af192fceab2302e17f666aabaacb5f97145d75c9c5172fbd31ba2ba42b9c66f6e9470699f48b
-
Filesize
864B
MD592dd1b5a463374142271ff420cb473a5
SHA1a9f946c6a8c6f273f837703acc74c367b7781a99
SHA256673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e
SHA5125e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01
-
Filesize
29KB
MD5a2819bc319ade96e220b81c11ba1fd62
SHA1f711920489d12ac7704e323de4cea98009299e7d
SHA2569976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e
SHA51264b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32
-
Filesize
1KB
MD58385a8a608e5cdd5a79957a6c979fb28
SHA1d20fd55ae3664cd339245fdd26a28983baf97f2e
SHA2565f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648
SHA5123bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac
-
Filesize
949B
MD5ae8c8f3d710c2c7a5cacbcef9c6f9646
SHA13fabbd5fcbeca40267f54aa7f523afa573062ad3
SHA2569aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68
SHA51294d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce
-
Filesize
1KB
MD5901e577d669d97e811a11f172dfb6655
SHA125d518b50deb389e311821d64d4b0b106618d7c7
SHA256245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5
SHA512ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
Filesize818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
11KB
MD5dfc1b916d4555a69859202f8bd8ad40c
SHA1fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA2567b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
SHA5121fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
-
Filesize
79B
MD524563705cc4bb54fccd88e52bc96c711
SHA1871fa42907b821246de04785a532297500372fc7
SHA256ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
SHA5122ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
1KB
MD5b862aeb7e1d01452e0f07403591e5a55
SHA1b8765be74fea9525d978661759be8c11bab5e60e
SHA256fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
SHA512885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
-
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
Filesize26B
MD52324363c71f28a5b7e946a38dc2d9293
SHA17eda542849fb3a4a7b4ba8a7745887adcade1673
SHA2561bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
SHA5127437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
-
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
Filesize28B
MD556368b3e2b84dac2c9ed38b5c4329ec2
SHA1f67c4acef5973c256c47998b20b5165ab7629ed4
SHA25658b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
SHA512d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
7KB
MD584b82e208b562cc8c5a48cf65e6ab0f0
SHA10adca343dd729beb86ebbb103f9d84e7ebbd17af
SHA256481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad
SHA512377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5
-
Filesize
1KB
MD55b29ab3cad80b08ec094c8201333ebe8
SHA1dee99f05b24963959159f1f061926e9075679be8
SHA25694ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867
SHA512a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
Filesize
186B
MD51d97bc3d56be902d4f63b37b05f3ad85
SHA1ace1fd823fc44e12a25448db2b5a49e20973e506
SHA2560eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46
SHA512fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee
-
Filesize
12KB
MD594443c174d88f844a9ccc4b910f630cc
SHA1fcb80696d47cad01738194971bc75c5e249044ce
SHA256ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56
SHA5121a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa
-
Filesize
985B
MD5f1f7369cd4f213cf2ae9469f4d1ef1f5
SHA1cd7f1eb598f3ed855eb9033010dafc0198bf70c1
SHA25610623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18
SHA51254b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e
-
Filesize
2KB
MD50dd63ef9ebbb7c6f5a20aaba3d799be6
SHA1bd7d41bbdf8dce506c049cdcb339c6015fb11290
SHA2566537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5
SHA512b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb
-
Filesize
1KB
MD5553252424d89d17aade6a0bdab1f1c1d
SHA11cb30c6f75014eec81b10c27d51413a2f0fafadb
SHA25689ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f
SHA5125e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c
-
Filesize
1KB
MD5aa721fce40b4331d0ded9cb9c29ea599
SHA1aeda7805291dca4b7fac211a623fd103e51f10ed
SHA256ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca
SHA5120e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e
-
Filesize
1KB
MD580bdf8901061eac24047d6b001499e89
SHA1a99d447473406d5e862ae9337b7aee363a8d2f13
SHA2568d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c
SHA512b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
3KB
MD5aaf4d3f519676aa3f490218a47fa6042
SHA19991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753
SHA256f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c
SHA5124ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085
-
Filesize
1KB
MD5b9eb984a5b149084bb675358404d83ee
SHA12c87199e46d74c4de3202607efde64947bdc250b
SHA25625f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380
SHA5124f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
Filesize
8KB
MD5f745bb0f4002c0aa36126e746de7b42e
SHA1e457241c0a0e36daf5be5a1378bf54f992d08408
SHA2569859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3
SHA51242d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6
-
Filesize
333B
MD54bb860ccb55a8e7f8e15094c423bf190
SHA1337cbb70f03b1e4a6128670ae8687cb4e2c337b5
SHA256af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962
SHA5120c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b
-
Filesize
168B
MD5fc7283ee28a91d78c8e336e34115a423
SHA1bc78998bd04ce27fd79dd5585ea9d9858fb929cb
SHA256cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8
SHA5121e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4
-
Filesize
1KB
MD5908ee832e1efb27e9faa3318cbc40675
SHA1f48baa57e29980f9602f30351fd68ba2da243ce9
SHA256a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019
SHA512310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
Filesize802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
Filesize16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
757B
MD58bb6f78000746d4fa0baf4bdbf9e814e
SHA14b7049331119a63009aec376677b97c688266613
SHA256a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8
SHA512ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262
-
Filesize
474B
MD554bd6e9d21ed6021e374d34cfaa3290c
SHA1e71ef5c7bf958f1599fce51cc98a73f849659380
SHA2564e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036
SHA5127424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407
-
Filesize
1KB
MD5e6b2ad09f00a37da8012022f4b9e0461
SHA19af557e76ab4036536d792ca9b3c37d4720c0587
SHA2562d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4
SHA5129ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7
-
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Filesize17KB
MD5cf8f16c1aa805000c832f879529c070c
SHA154cc4d6c9b462ad2de246e28cd80ed030504353d
SHA25677f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
SHA512a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
-
Filesize
15KB
MD59841536310d4e186a474dfa2acf558cd
SHA133fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA2565b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
SHA512b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
-
Filesize
6KB
MD5a635c09a3ba36d76e04158ba070c32e2
SHA16bdda03a1e34946e25fced365eb9da0df97e9e29
SHA2566f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446
SHA512cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818
-
Filesize
538B
MD56895fc6423c97fbf721a71333137d1ca
SHA1e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e
SHA25621b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8
SHA5120cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0
-
Filesize
133B
MD535b86e177ab52108bd9fed7425a9e34a
SHA176a1f47a10e3ab829f676838147875d75022c70c
SHA256afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
SHA5123c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5eef4d122f8bf1654f2fa39587b4bc772
SHA144a154a863d3284a00dd52881534b35d0eedd6d0
SHA25690dfae0c893bcfeca726e1c5ee01121213f1bf56f365ebcd24f8a2173b6b06d6
SHA51227402871d4e035000ac1b9259d9631cc30815fe1982f6b2d2c1d6db082e2496f8d55547f65bb2dbfd77b3521fd66fc438bed7ddc5efe90e9914cdee5e2eeb4d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
Filesize727B
MD521fa5777ea4ab164dae993a4b0bf6d72
SHA17208c8c8b18869ee177a2ccf891f1cb55fe2ea27
SHA256a1bd67880fae968a874e4d7598edccde074fb3e75a1f44c3583cf19e379bf467
SHA5127f1f193e41d23821272697a181c5c253c0de628150ba324e964f90ae23f1ead09b77344f9de3cec096019347bce2fd5b4f15bf1d580aef8a3c0f2998d8dff0f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5397ff398089ad38f837ed86c42e78205
SHA18aeb6f8664552b8486b41cbf7546219c5fc5e7d7
SHA256712f75d7057e41be9228c2c7267c39993f3bd618b468d1e44c233bbe76cfed1d
SHA5123ac2414e49638504a079a4e2b6ea08441fed868d1c3a3c0ae3ee99e64c6c61f03118483609751dab9da3ff5d7fa08c887661205017afd6e011d433bcbd26d0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5189dfd18aa5ee7f0e654e12279325c75
SHA18d3d3ece91f68dd5d393a3f178b0f2165502259a
SHA256d98e75e180e4b0f5fa3a1b8d0ed59d7865a230f867c0ecc22cef2410d5455381
SHA512402bbea620d974f9980a66b33b419aeb3d46ceb5f2783c3470e1bc5c6b4504c4b47a5b6f37ec9c2eea518fdc01033a007cc09c28cae2845fb28173af38ef5c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
Filesize404B
MD5ad75cdc08e58c62941ac326942418f45
SHA192abc7b37fce0f4d2f7a4836d73746fcda26f825
SHA256a56a7f592dc9bf1452d4ed8dcff0096147c9bcab2024258881320faacb1eaa4c
SHA512dbe3656a35e9a943dd4b8f9ced2acae4a52e89a2d5ad56cdd7b7b2da93f1636abe1b015f154107a1de76ef133d601ac796a1728082bd14e7ab14ee5229e3f8e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD544b747210642a9cfeb2aa172bacee8fc
SHA11b179cc83fa70c13815bab3042157f9a8af46aa8
SHA25669ad96424c21bac0cb6f4735aca262927520d137d45a084f9828c8d5f9ee0cd0
SHA5126759eb1c62703dddb35584e485856dee38c45e11302f6e5e57c054a2dd0946fe93b481796acbb72a05c4b13f959017578ceec50afa8dcf644155032511c27ea0
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD53d8a7519fdf068ae8301e59e3efa0aaa
SHA12b027fc4f145a28e9f5383ddf7f9106a56b3bff3
SHA256daa019edbcc191894b7b1bf9149b188b28b4a8de70ceeb0608ef7ed1c15da0ca
SHA512e48406afb13ae438b4f7d248217a65231ca1532482192ff18350a2a7f2631a05d2000d284806aeb62ddd618ffc7dafbd9ab6ad124198c864bfa5dd19fccd609b
-
Filesize
251B
MD5e9290feaa17eb5dab0633153bf11802b
SHA11d59f60548c2cd9183aa3361f0b97003812c4942
SHA256fc1c33415e87f34cd61da02177cacd32ac81ed80182a2922f22ffc63bc39c241
SHA5123e55911f0600d4cd361252eba21843ee2c3b8b4944c1ad89b19a7cbaa31d3b9c20dd46824a59ea75d902f2d5c0f0bb828767c2d5acc4c029a2e8506ec5e04b37
-
Filesize
6KB
MD5376e786020b371d92f6c26d083d86a50
SHA1f7bc5a27908e4e80ef7f9991dab01a58b102c020
SHA2567529bfacf294b2f506cb9275f6c3d424aae10f4c8fd816e741d85440138202a7
SHA51268bfdf4d38ef597cf8877a075f8f462159cf77388cd03f55bb59c53af4b6b3d2897e9d6ea07500d378ba722ef67420a5d932b3c43fbd432019ada23279d99c71
-
Filesize
5KB
MD501f1d631d386ed68f1d1adb3d4957734
SHA107210a8038eb3a5e9ea84c3cc3d718706eb83e6a
SHA2563609c13117d61109f2bedb737decdef3fbf78af4810b1f79ca886b391ac92460
SHA5127679f74ff57619b6d40a3ad8015d1aa54a7f5c27bb2c0552d270028fb877af12aa33f8baf499c96b04b3f4fc0c2b31234b32feb1173f53ce42a950feabdf5be1
-
Filesize
6KB
MD5526b73a6976039bad4a0e169a09ac17d
SHA1bf3dd8cc0de9fa2938a04fbb99348108e7607bdf
SHA256a7957c9d9223bfb746ef686a94a69dd28fcd2016478a324275fa5278986a7ce3
SHA512ac63d76e98c39238557bcf67b185f1a54181e3cacef6eb1577d73f10d6309e3aa5e072d21cea01c6460e1a963190da273d337783edf78d0a14d2c3925df4758e
-
Filesize
203B
MD5807375d95722cbe04dd379190e235d4f
SHA16446d06b6ecc8d605e130c5b64fa7d29b0f19a00
SHA25630b1c202276b92228224c1b42a773c4b7186950fe11a37bbb82c18599fc23733
SHA51281d4e7106ece50a98c1d20af0b43e5f51dc15e5b240ef265fa27be5a0ee975265c708189dca7accd2be649afddd6b0e1f2a6ab773a7793cef41f7e6fb10f6a8e
-
Filesize
203B
MD5ab6b3a4b0eac778bb062ca6599d4c188
SHA1171ee4cbdbb58536f5a1d8fe80317be5b40c0d2f
SHA256c28403ab61aeb81ee0ab7b7049900aba0d088d9db0b7e42cff36488ecc99d0dc
SHA512cad8d18829f101aa0a93058e1ebbd023e57d40f8c0c4f482523b67c7bfbaaa0e63238c1f55d9e4dc08a2a31a95470c0e5845a97d95e1fd3f65d1507a9f5666dd
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e1b93be845f32bccff16aec5ce150674
SHA111fdaec3a7876fe5486cbdea657784330ff6a123
SHA2563fcd284e4eadef784637e9bb7f03039836b4c9648e8e3e708b3cce7bacdc4943
SHA51249f52895b5888e61a4b4dc14cf87fe7eda2116f2545b2e95b1fe48eb8edb9413c44cc314082114207be8153ff7dc7c3245d9eb1886540817fff0c56d394ac7ff
-
Filesize
10KB
MD5172a6a4e2bf43c9c26cd9735a8b853db
SHA1cd5ba707ca458fec4676bf985e2df7042f07be33
SHA256ccdc99b5ee24151acd5ab0e37fda7df75f172c97f0f7226ec0f2df304024b541
SHA51293d2be283ca0243aff74abd29c11c3868b2a043747af96d8456fa01ec6e75140ec3cda96ef8c6b0c1633b88058c9cf0ae761c270f45b7ae96fac79f486014adf
-
Filesize
144KB
MD57fa9d662d634534d7c2240dd126bdeee
SHA1bd01e22ed2da0d0d485824b372ac67da683863d2
SHA256c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206
SHA512cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81
-
Filesize
390KB
MD580bebea11fbe87108b08762a1bbff2cd
SHA1a7ec111a792fd9a870841be430d130a545613782
SHA256facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1
SHA512a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
28.9MB
MD5fa9e1f3064a66913362e9bff7097cef5
SHA1b34f1f9a9f6242c54486a4bc453a9336840b4425
SHA2569eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
SHA512ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f
-
Filesize
341KB
MD574528af81c94087506cebcf38eeab4bc
SHA120c0ddfa620f9778e9053bd721d8f51c330b5202
SHA2562650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34
SHA5129ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae
-
Filesize
41KB
MD561b9531016242facf3f1f98803b5d612
SHA11237539b293ab11e931f748a4e3b7a50e292710c
SHA256a1a07df1aed70884029f7ec5c8ce2b1842b42fccf1a2ad416d852beb20b1c922
SHA5123571e34953b00fdb83f2f24834ffcef6cc1b945ca870e7e0a45b4ef0e61c78fa65842d49b6dbb56bf2cab0faca367e1da4fd4440b314352929672d73adde8032
-
Filesize
45KB
MD58afe38f635bb63bdaca034ad4103bdad
SHA1e5787e022f98b1ead00689ae6533957248026c6b
SHA2562206793d966a2b0c1aa9aba3b86b80c31647c91332b2ace730190019ec0d430f
SHA51253eb1fa395f82047301b4cf291b632b64a7f043a5610e821d665374e8ffdcd2bdf86ee8b5e9e7cbd2641fff8504a1930155e89e277b2f9fc595790c3afeb3636
-
Filesize
70KB
MD5a3965172cd91f1667562972289516a4d
SHA16712bd539b77963e0e4ba544b0a451db9d4fb05f
SHA2564ca5140c99d8de2368886bba6650779a21fa314ff76050c519f755832c2eed79
SHA51283e1bf3ee103580333177d8457eba776248a3c2e49f409b63ff114f96131428ff39ea392ac3c1aed48abdb16e319fda75d1a9217172a9bcb46c4d80626084160
-
Filesize
24.1MB
MD5211d4d6387925fc5c8da8d773134cfcf
SHA1aec93b2bc5bb91e41f4742d399d762b0317050cb
SHA2561579040f463ba02b24668e3b8e23764e7172417207bd3b6023e1ebd67d8468e1
SHA5123939335fb6485821fddc52fc1a65eac15bc86cfc6db1e5990dd61a1dd927cda6e0526dc23c687d24421954e1249b94eab715c999bfc26439a5c3d85bf98effd2
-
\??\Volume{ff55cfe6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dd31f5d3-8ec5-4e71-a47f-9eacdf56ba83}_OnDiskSnapshotProp
Filesize6KB
MD5c517297b9b0347d215cbf3059d800363
SHA16e6c00beef78c66eb30ffbc27e4caf0098187019
SHA256673978de2ac65aa81ec8d9bc6128e4e719c4d309f8c96a3c55e6ff7114a90684
SHA5122dd5b39d7d5afed4db47dd86bce34909fbffc456e6ba2e212e3ebbd206748aa76e03096123ba64659cd884fa9be8ae06249f7d815b52d8ac40ea032d7b2be419