Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/12/2024, 13:09
241219-qdzx4stlfy 1018/12/2024, 23:58
241218-31jwmaxpcs 1018/12/2024, 23:03
241218-21nddawjh1 718/12/2024, 22:59
241218-2ywlzawjcs 718/12/2024, 22:44
241218-2nva6avnfy 618/12/2024, 22:36
241218-2h9tnawjal 618/12/2024, 22:31
241218-2fnteavlbz 10Analysis
-
max time kernel
809s -
max time network
562s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/12/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
node-v22.11.0-x64.msi
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
node-v22.11.0-x64.msi
Resource
win11-20241007-en
General
-
Target
node-v22.11.0-x64.msi
-
Size
28.9MB
-
MD5
fa9e1f3064a66913362e9bff7097cef5
-
SHA1
b34f1f9a9f6242c54486a4bc453a9336840b4425
-
SHA256
9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
-
SHA512
ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f
-
SSDEEP
786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1160 msiexec.exe 4 1160 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\posix.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\lib\common\node.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\minipass-fetch\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\binary-extensions\license msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\node_modules\minizlib\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\@npmcli\fs\lib\move-file.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-start.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-hook.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jackspeak\dist\esm\parse-args.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jackspeak\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-explore.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man5\npmrc.5 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\mjs\index.d.ts.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\mjs\opts-arg.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\convert\xml.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\address-error.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\retry\Makefile msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\rimraf-manual.d.ts.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\dotalign.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\yallist.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\verify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\chownr\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-name\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\brace-expressions.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\cache-dir.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\pnpx.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\node-gyp\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\archy\examples\beep.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\mjs\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-packlist\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\team.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\has-magic.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\processor.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\default-tmp.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\rfc3161\error.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\rfc3161\tstinfo.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\glob.d.ts.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jsbn\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\dist\commonjs\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\agent\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\rimraf-manual.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\preload.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\shrinkwrap.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\lib\breadth.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-version.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\update.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\trust\trust.types.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\vendor\QRCode\QRPolynomial.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\mac_tool.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\nesting.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\rimraf-manual.d.ts.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\win32.js msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7ABE.tmp msiexec.exe File created C:\Windows\Installer\e583b8d.msi msiexec.exe File opened for modification C:\Windows\Installer\e583b8d.msi msiexec.exe File created C:\Windows\SystemTemp\~DFB4EC47D3478B1F9E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82} msiexec.exe File created C:\Windows\SystemTemp\~DFFA5D88580F765DDE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3CB6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3D24.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI77FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4478.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI495B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon msiexec.exe File created C:\Windows\Installer\e583b8f.msi msiexec.exe File created C:\Windows\SystemTemp\~DF4D28C16EC21DF9F2.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9E613F166DFDB335.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 7 IoCs
pid Process 2988 MsiExec.exe 2988 MsiExec.exe 3712 MsiExec.exe 3712 MsiExec.exe 3712 MsiExec.exe 1060 MsiExec.exe 4684 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1160 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000485242783223abf50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000485242780000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090048524278000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d48524278000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004852427800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Version = "369819648" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductIcon = "C:\\Windows\\Installer\\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\\NodeIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductName = "Node.js" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\NodeRuntime msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\DocumentationShortcuts msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\corepack msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPath msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\PackageName = "node-v22.11.0-x64.msi" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\PackageCode = "7ADA4E96FE88DF64FB4F54512750A882" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\011B2C6A4395F7A48B1C157EDC15FF28 msiexec.exe -
Runs regedit.exe 1 IoCs
pid Process 4256 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3756 msiexec.exe 3756 msiexec.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3288 Taskmgr.exe 4256 regedit.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1160 msiexec.exe Token: SeIncreaseQuotaPrivilege 1160 msiexec.exe Token: SeSecurityPrivilege 3756 msiexec.exe Token: SeCreateTokenPrivilege 1160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1160 msiexec.exe Token: SeLockMemoryPrivilege 1160 msiexec.exe Token: SeIncreaseQuotaPrivilege 1160 msiexec.exe Token: SeMachineAccountPrivilege 1160 msiexec.exe Token: SeTcbPrivilege 1160 msiexec.exe Token: SeSecurityPrivilege 1160 msiexec.exe Token: SeTakeOwnershipPrivilege 1160 msiexec.exe Token: SeLoadDriverPrivilege 1160 msiexec.exe Token: SeSystemProfilePrivilege 1160 msiexec.exe Token: SeSystemtimePrivilege 1160 msiexec.exe Token: SeProfSingleProcessPrivilege 1160 msiexec.exe Token: SeIncBasePriorityPrivilege 1160 msiexec.exe Token: SeCreatePagefilePrivilege 1160 msiexec.exe Token: SeCreatePermanentPrivilege 1160 msiexec.exe Token: SeBackupPrivilege 1160 msiexec.exe Token: SeRestorePrivilege 1160 msiexec.exe Token: SeShutdownPrivilege 1160 msiexec.exe Token: SeDebugPrivilege 1160 msiexec.exe Token: SeAuditPrivilege 1160 msiexec.exe Token: SeSystemEnvironmentPrivilege 1160 msiexec.exe Token: SeChangeNotifyPrivilege 1160 msiexec.exe Token: SeRemoteShutdownPrivilege 1160 msiexec.exe Token: SeUndockPrivilege 1160 msiexec.exe Token: SeSyncAgentPrivilege 1160 msiexec.exe Token: SeEnableDelegationPrivilege 1160 msiexec.exe Token: SeManageVolumePrivilege 1160 msiexec.exe Token: SeImpersonatePrivilege 1160 msiexec.exe Token: SeCreateGlobalPrivilege 1160 msiexec.exe Token: SeCreateTokenPrivilege 1160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1160 msiexec.exe Token: SeLockMemoryPrivilege 1160 msiexec.exe Token: SeIncreaseQuotaPrivilege 1160 msiexec.exe Token: SeMachineAccountPrivilege 1160 msiexec.exe Token: SeTcbPrivilege 1160 msiexec.exe Token: SeSecurityPrivilege 1160 msiexec.exe Token: SeTakeOwnershipPrivilege 1160 msiexec.exe Token: SeLoadDriverPrivilege 1160 msiexec.exe Token: SeSystemProfilePrivilege 1160 msiexec.exe Token: SeSystemtimePrivilege 1160 msiexec.exe Token: SeProfSingleProcessPrivilege 1160 msiexec.exe Token: SeIncBasePriorityPrivilege 1160 msiexec.exe Token: SeCreatePagefilePrivilege 1160 msiexec.exe Token: SeCreatePermanentPrivilege 1160 msiexec.exe Token: SeBackupPrivilege 1160 msiexec.exe Token: SeRestorePrivilege 1160 msiexec.exe Token: SeShutdownPrivilege 1160 msiexec.exe Token: SeDebugPrivilege 1160 msiexec.exe Token: SeAuditPrivilege 1160 msiexec.exe Token: SeSystemEnvironmentPrivilege 1160 msiexec.exe Token: SeChangeNotifyPrivilege 1160 msiexec.exe Token: SeRemoteShutdownPrivilege 1160 msiexec.exe Token: SeUndockPrivilege 1160 msiexec.exe Token: SeSyncAgentPrivilege 1160 msiexec.exe Token: SeEnableDelegationPrivilege 1160 msiexec.exe Token: SeManageVolumePrivilege 1160 msiexec.exe Token: SeImpersonatePrivilege 1160 msiexec.exe Token: SeCreateGlobalPrivilege 1160 msiexec.exe Token: SeCreateTokenPrivilege 1160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1160 msiexec.exe Token: SeLockMemoryPrivilege 1160 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1160 msiexec.exe 1160 msiexec.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe 3288 Taskmgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3756 wrote to memory of 2988 3756 msiexec.exe 80 PID 3756 wrote to memory of 2988 3756 msiexec.exe 80 PID 3756 wrote to memory of 2952 3756 msiexec.exe 85 PID 3756 wrote to memory of 2952 3756 msiexec.exe 85 PID 3756 wrote to memory of 3712 3756 msiexec.exe 87 PID 3756 wrote to memory of 3712 3756 msiexec.exe 87 PID 3756 wrote to memory of 1060 3756 msiexec.exe 88 PID 3756 wrote to memory of 1060 3756 msiexec.exe 88 PID 3756 wrote to memory of 4684 3756 msiexec.exe 90 PID 3756 wrote to memory of 4684 3756 msiexec.exe 90 PID 3756 wrote to memory of 4684 3756 msiexec.exe 90 PID 72 wrote to memory of 3288 72 cmd.exe 98 PID 72 wrote to memory of 3288 72 cmd.exe 98 PID 72 wrote to memory of 1076 72 cmd.exe 99 PID 72 wrote to memory of 1076 72 cmd.exe 99 PID 1016 wrote to memory of 4256 1016 cmd.exe 107 PID 1016 wrote to memory of 4256 1016 cmd.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1160
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 25EAA1C940BC82CA736C477E15AB1B84 C2⤵
- Loads dropped DLL
PID:2988
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2952
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C549E8AD0222A9D50938148B63E48DAD2⤵
- Loads dropped DLL
PID:3712
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 54CA40165AEC9D3BABBE41DE5EFC9953 E Global\MSI00002⤵
- Loads dropped DLL
PID:1060
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33DDCCC13DC8275ED325E60C1B6DE7342⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4684
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2864
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:4852
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:72 -
C:\Windows\system32\Taskmgr.exetaskmgr.exe2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3288
-
-
C:\Windows\System32\Wbem\WMIC.exewmic os get lastbootuptime2⤵PID:1076
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4776
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\regedit.exeregedit.exe2⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:4256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
935KB
MD50fcb45c6f691904bb16d76fb8def5362
SHA11927a19dd255ef691f4864b41514457dfaeac9c2
SHA2566c793c52fcd3a2e1cfae5db79762a0972e9abf867cba8f523b8bb9c8dc77cff8
SHA51200df17c3bf46ba7f58651190284eaa97dabc3761ab0431956427e12e8e9eea5871654614eeed6ed07c996106f05c1f2adc792262096490af01b05f4959810fc1
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
Filesize818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
11KB
MD5dfc1b916d4555a69859202f8bd8ad40c
SHA1fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA2567b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
SHA5121fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
-
Filesize
79B
MD524563705cc4bb54fccd88e52bc96c711
SHA1871fa42907b821246de04785a532297500372fc7
SHA256ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
SHA5122ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
1KB
MD5b862aeb7e1d01452e0f07403591e5a55
SHA1b8765be74fea9525d978661759be8c11bab5e60e
SHA256fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
SHA512885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
-
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
Filesize26B
MD52324363c71f28a5b7e946a38dc2d9293
SHA17eda542849fb3a4a7b4ba8a7745887adcade1673
SHA2561bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
SHA5127437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
-
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
Filesize28B
MD556368b3e2b84dac2c9ed38b5c4329ec2
SHA1f67c4acef5973c256c47998b20b5165ab7629ed4
SHA25658b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
SHA512d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
Filesize802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
Filesize16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
757B
MD58bb6f78000746d4fa0baf4bdbf9e814e
SHA14b7049331119a63009aec376677b97c688266613
SHA256a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8
SHA512ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262
-
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Filesize17KB
MD5cf8f16c1aa805000c832f879529c070c
SHA154cc4d6c9b462ad2de246e28cd80ed030504353d
SHA25677f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
SHA512a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
-
Filesize
15KB
MD59841536310d4e186a474dfa2acf558cd
SHA133fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA2565b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
SHA512b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
-
Filesize
168B
MD572b8c907a5d50eb4917010e78ef8a23b
SHA1a3e7ebff0927ae76cecdedb6e81422be78786bd3
SHA256f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20
SHA5129def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc
-
Filesize
133B
MD535b86e177ab52108bd9fed7425a9e34a
SHA176a1f47a10e3ab829f676838147875d75022c70c
SHA256afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
SHA5123c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5159239844fe85a7b6b4358e3dfb73039
SHA127f9fdb4b407665cb8446171b56bae1dbbf05041
SHA25654f705bfa7da9d40819e923eacce8a3b1dde70b2196e0cea0893f7c287b2acae
SHA512059596d7267046d98d7cda1a1af7311c2a8d4c2c32a864a99fbaeaa1568cd9d1c37a7869ff3eaaf344d2ec410cdff97c81cedc1cce1e7e48935ffecc7d76615c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
Filesize727B
MD592e2c8647142881c6854724d3e3d0aac
SHA1d7d2a39374b3e913f6981fb5af3ccf47c02b0e84
SHA256e911720fd72f86ac93c5a1b292a9a7d1b316ab09886a21ce211fc7adaae950dc
SHA51222f91907b1a417153ec66f17117ae1ee5b2da7a13dade25ae0690248931ec73dd06f49776c1e7124afe8b067d62db7fefc90c1777a5c93e4a22403c66c8198fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD56e8abcfde63a04d6c0f7fae95d6f98a8
SHA1d8c3bd8e7a0d18fd4435a0842dc1f4fc4b76f367
SHA25625f012ae852b065244e4312ad1dd00dfb30b151c2cdf97024d49665a04d9ef2d
SHA5124577c8e553d326b1a1c4f93cb6a8dd40486f8d9cad3009fd8a2006f4749667dd10999ae198aa9e37569a8e88f3b5d28819872f7e572a5b4ccc05eafb0cd1942f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5a11d90c34bc8bd33cadab4f22218e9d0
SHA19839d468d320787fa26a24309733ac2d303b214e
SHA25640b4c54d0dc27d509ca60f25ee0c225876cc8cdc9e9d71872a063e2802986e44
SHA5126703696b689f42f912fe86ddbe7a630391dc8da3cf42447bcb250408111ab5f6c1bfd639a4bd10c4f4a8b53aeec36d3c269b548589ba7f24a0b7e804615df8cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
Filesize404B
MD59db70bb0c0f655ce5ab631203bd72c1b
SHA188666c6944f390ed6cabda340da8b6b5941b4c5a
SHA2568ff38b749e216ac7e9da66eda9a96f71354fa94e3add37588709f37f2af55dd5
SHA512a7f3760419d011dfabfc1f0830d710c90de50d00e888d3f432ad3234bcf64bf3cdc34de2b1f8014ee45f7186fdb4957aba855c5c406a022254ab5aff28e33219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD59cbbd1739309c54c03ea603f972ab11f
SHA1245058f4fedd918afd328635f03e3595bed0bd0c
SHA25612433460b37a8d06076baa5147dc55cd6e2f75cab13f3378f2a9c98e92f84f93
SHA512842b2436e3cd7ab897ae7c80f5115e43cc5e75a5fbdb68d6aae4d672670a07e7512b3d09171dc57fce4645176dd36ed29d5fcf5c78b4b866eefb36576568abcd
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\5b94629c-3026-4ae7-b4e6-1affa09adcbd.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
144KB
MD57fa9d662d634534d7c2240dd126bdeee
SHA1bd01e22ed2da0d0d485824b372ac67da683863d2
SHA256c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206
SHA512cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81
-
Filesize
390KB
MD580bebea11fbe87108b08762a1bbff2cd
SHA1a7ec111a792fd9a870841be430d130a545613782
SHA256facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1
SHA512a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6
-
Filesize
341KB
MD574528af81c94087506cebcf38eeab4bc
SHA120c0ddfa620f9778e9053bd721d8f51c330b5202
SHA2562650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34
SHA5129ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae
-
Filesize
28.9MB
MD5fa9e1f3064a66913362e9bff7097cef5
SHA1b34f1f9a9f6242c54486a4bc453a9336840b4425
SHA2569eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
SHA512ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f
-
Filesize
24.6MB
MD546e3ae5c4b36423abd041b33e9722f9a
SHA1f90edca84ce3b008efea3dbb4c33318757ec5522
SHA25649286c0484530fe196f786b6b3a0febcfc0cc8dba22b9498d9635f7ab13fde3a
SHA512697dc82b2e35fc11a879029077d463d074bcab9ff7da345798410eee6c18716a9641cd555fc8908a32ea01522002a9f429cea03c2388df55081c3c68c7856403
-
\??\Volume{78425248-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cd0b0cbd-70a0-404c-b668-75681c808706}_OnDiskSnapshotProp
Filesize6KB
MD5ac2af47495b65550092dcf7003972f66
SHA10f9eaee9c42f5ab71ed9019c9c2287498823673b
SHA2568f1f0423b56d32e677a0a1f5f1f010403bed8c748cd36e3194a9fe73e7b9afbb
SHA512dc06bb026f6a4b4461ebe70692b0ff9e60ca82a62bdcb1787a9e645b5134757517f2fe8742c2bc7c1afe6e646239cb1ec5bd732bb880ea9d678427e6aa2ba55f