1071dd8ea5ca9a5c66be3120c38b6aa87eb27ae0ff5809e950951918e9267b64

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.bat
Size 128B
Sample260504-3atcdadw2w
SHA256 1071dd8ea5ca9a5c66be3120c38b6aa87eb27ae0ff5809e950951918e9267b64
MD5 66f5e42621943f3e730dda59abad3b9f
SHA1 12a561c24e1ac9d338ce2213b49354557b0e873a
SHA512 dfbb7d36fe9c04a725e41c52fd5aa7d5e3bc938efe2dbd4902904c574b5df64a3401349262547fd79c15bc0ecf194201f0825d909ea940b6097b519627f54a5a
TLSH
T19CB012974D01C08710133D06E57DB247703B50FF0785A80378403C95B95C344C457DE7
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
5132	MsiExec.exe
5132	MsiExec.exe
4100	MsiExec.exe
4100	MsiExec.exe
4100	MsiExec.exe
4284	MsiExec.exe
1332	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
113	3652	msiexec.exe
115	3652	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\LICENSE.BSD	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\dist\mjs\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\esm\process-umask.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tinyglobby\node_modules\fdir\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-cache.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-restart.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\lib\options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\protobuf\timestamp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\bundler\message.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\timestamp\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\fetcher.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-uninstall.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-repo.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\lines-to-revs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_trustroot.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\processor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\proggy\lib\tracker.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\commonjs\large-numbers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-sbom.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\ll.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-outdated.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_rekor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\man-target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\dist\esm\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\exponential-backoff\dist\delay\delay.base.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\gyp.bat	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\config.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\using-npm\package-spec.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\developers.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\rekor\v2\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libesm\diff\line.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\bom-handling.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\workspaces.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\pattern.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmteam\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\dist\mjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\util-deprecate\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\npmrc.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\format-bytes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\orgs.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\lib\npa.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\to-comparators.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\doctor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\guard.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libcjs\diff\json.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libesm\diff\word.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\dist\esm\constants.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-config.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-search.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\cmd-list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\signal-handling.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\version.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-docs.html	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8CD8.tmp	msiexec.exe
File created	C:\Windows\Installer\e59843c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8563.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{943F6D8C-08E2-4F54-8E3D-623E82DC6BF0}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABCC.tmp	msiexec.exe
File created	C:\Windows\Installer\e59843a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59843a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{943F6D8C-08E2-4F54-8E3D-623E82DC6BF0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA989.tmp	msiexec.exe
File created	C:\Windows\Installer\{943F6D8C-08E2-4F54-8E3D-623E82DC6BF0}\NodeIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007d3725990023bfe00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007d3725990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007d372599000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7d372599000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7d372599000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224103833270099"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\npm	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\ProductIcon = "C:\\Windows\\Installer\\{943F6D8C-08E2-4F54-8E3D-623E82DC6BF0}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPath	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\PackageCode = "DCAB0170A9ED096498893F755C467418"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Version = "403636224"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\PackageName = "node-v24.15.0-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\DocumentationShortcuts	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
2276	msiexec.exe
2276	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
3652	msiexec.exe
3652	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4364	1572	chrome.exe	99
PID 1572 wrote to memory of 2968	1572	chrome.exe	101
PID 1572 wrote to memory of 2680	1572	chrome.exe	102
PID 1572 wrote to memory of 2968	1572	chrome.exe	101
PID 1572 wrote to memory of 5888	1572	chrome.exe	103
PID 1572 wrote to memory of 5888	1572	chrome.exe	103
PID 1572 wrote to memory of 3284	1572	chrome.exe	104
PID 1572 wrote to memory of 5996	1572	chrome.exe	105
PID 1572 wrote to memory of 3284	1572	chrome.exe	104
PID 1572 wrote to memory of 5996	1572	chrome.exe	105
PID 1572 wrote to memory of 2540	1572	chrome.exe	106
PID 1572 wrote to memory of 2540	1572	chrome.exe	106
PID 1572 wrote to memory of 6128	1572	chrome.exe	108
PID 1572 wrote to memory of 6128	1572	chrome.exe	108
PID 1572 wrote to memory of 3372	1572	chrome.exe	110
PID 1572 wrote to memory of 3796	1572	chrome.exe	112
PID 1572 wrote to memory of 3796	1572	chrome.exe	112
PID 1572 wrote to memory of 5308	1572	chrome.exe	113
PID 1572 wrote to memory of 5308	1572	chrome.exe	113
PID 1572 wrote to memory of 2452	1572	chrome.exe	114
PID 1572 wrote to memory of 2452	1572	chrome.exe	114
PID 1572 wrote to memory of 4704	1572	chrome.exe	115
PID 1572 wrote to memory of 5748	1572	chrome.exe	116
PID 1572 wrote to memory of 3676	1572	chrome.exe	117
PID 1572 wrote to memory of 2256	1572	chrome.exe	118
PID 1572 wrote to memory of 3652	1572	chrome.exe	119
PID 2276 wrote to memory of 5132	2276	msiexec.exe	121
PID 2276 wrote to memory of 3180	2276	msiexec.exe	125
PID 2276 wrote to memory of 4100	2276	msiexec.exe	127
PID 2276 wrote to memory of 4284	2276	msiexec.exe	128
PID 2276 wrote to memory of 1332	2276	msiexec.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
PID:4300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc0e6ac728,0x7ffc0e6ac734,0x7ffc0e6ac740
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,3058851631908683600,11308547926361480583,262144 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,16511852500037243016,9873664553918767362,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,4406138517904865616,12421807906066609711,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,15338569364033798269,14443794956166738384,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,17501611706227768741,6083277100642543455,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,9015806897795907195,15547515782149277770,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,5743008064075860472,8950229356764421945,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,12536854588452790713,10548581906541794569,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5772,i,4678096369539188851,14061600154625255412,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3280,i,3390044231287367961,11807046961651071685,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3464,i,15229431971975432988,16815570814543761240,2097152 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,3519364218053499267,2473410073049223719,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,1926061609346004126,11278454364487859690,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,10165589053697066376,3261736256408133581,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,1728380772837743601,4478703628341048248,524288 --field-trial-handle=1972,i,7955958669679672532,5911412074240175793,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:2256
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v24.15.0-x64.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5C9C2CA93A92C6C4FE93588E3C6745C9 C
  2⤵
  - Loads dropped DLL
  PID:5132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3180
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EB42B551ACDE3628D28A32582A304C1F
  2⤵
  - Loads dropped DLL
  PID:4100
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DF38BAE9E9224E490D11CEB6744632F0 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:4284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E2BD0E9D9BC21D77CEC213D0B9D20CE4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59843b.rbs

Path C:\Config.Msi\e59843b.rbs
Size 774KB
SHA256 77e8ea1f03df65aab4050e9c5643d102ddb2e9a91de83fc2ec68e284460ce5ce
MD5 f70ebc3ba7b9030773ba43774de037b8
SHA1 aff1a876f1f5f9013885dcc76c746b173d5d738b
SHA512 4b87d05c7a498a89761b041ce21f4758b099086d3208aedc32e860d8c5785d368c450c24c2f7296411980d6306c3ef86f5ea40ae083e8369a6a3b787b2df840c
SSDEEP 12288:Q5lw0IAjA+S59nDPNWMrhl9Kmf3pZ8lS3TAT+erw27WHdwLGu38M00:QICUTACd27WH+BsM00
TLSH
T158F4B7706DF188EEE9057171B39470319FACADCA6F40582D1BCC87BAFD6A6F091B8644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Size 168B
SHA256 b03b50ba347335ad4972b70d673269911b669a05673c58fc9c2a62d935bf8966
MD5 4224bb0d45200da733785788bc72979e
SHA1 8b234c74a4ddc241336657a0e0fcf62fa7af6e27
SHA512 8ed9f025b7c77fafc34b0582000ad58a3c0cd72b71472df0908142b89b3b55c126fc41f104fcbd44c03b5ac7e1708b5728b7940ccde3b5cc9b5ed819ae353dbb
TLSH
T1ABC0809D960DC55AD34105478061FC14EC4F79E60CDFC41D11D4DD4F9D45050C80559B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js website.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Size 133B
SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
MD5 35b86e177ab52108bd9fed7425a9e34a
SHA1 76a1f47a10e3ab829f676838147875d75022c70c
SHA512 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
TLSH
T1CEC09BAD49098155D3424547C071FC48DC4E79D14CDFD45D5294DD9F5D84091C854569
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 f8fb9815474159c0e2c1733f8db07edb22c7f118ae6b6fffeb8e15dcf20bd882
MD5 681768003c2c1918237e03f7f95e6f1d
SHA1 94f6a365f765a15f548f27e87163eb0dedd5dd0a
SHA512 02e6221cf7d2ec283b52b40e9ed796d85b03a8b98ea18918021d3453e1ff16ee7c978ad5b7386cffc00ba35ff06f3a2193b0aa1b76cc1f8e6565cdf66c75223a
TLSH
T1775108CBCB262042B9069F62D3D4AEA7A4798B723DA185CDA5E5F0801C563E5B70D408
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 1KB
SHA256 4cfe9915db7aa7b7a0bcaba728475db8ee1d3c8590245e52920f0cb34e3b28ef
MD5 e73a0de7796b1a2b03e1ddaea6c2c028
SHA1 67e82ca9a42a7b576c56a8fb93457519b5f358e4
SHA512 8cfe1d133e4641fd58720d04a1a186e3e9ac5a33c2e0ef3210375de648a7e6df210d266c08b2ebe70e196560f0956351923674f2154e8af607dd79d6ef73c12f
TLSH
T1C52142F8641914A384E1BE30C2C25F87DDF51AB139C1F66F247C2F890868BC3EB62182
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 7a8a247d4b8ba35919ea815ec569794738968ef0660098106b6a9ab4e8fbae95
MD5 7db3e9e08000d8de550226566005a6bc
SHA1 e3aa488e0bc912ea209804c9a5790faade12cf76
SHA512 9a7c7d6a0ac246424e397d418d69ca6927c2b60a39597e3cab1921fe4f8a855a145fae8894de5e0650d919b025a8a889f4c2f34ab339b5eb2dc22dd37eb46eb2
TLSH
T1A30175A7D66D92C064E46950E728EBA7BAD2D3F23900BA2134BED25D00DD3811701426
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 556B
SHA256 a3b4ecd871a310be2959a909a158f31a76c4cc785a081f0d2496132457ab0bac
MD5 1bef417dc4be7953522c9130f8116f93
SHA1 bb366afc12c869c281180d2104ef4e861902df5d
SHA512 e43fe5345a4ac7b40974cf4a11d7801c788abde2d33e2173eea6d7b695aed692db667a216717e04615a1e52bd6b0111b7e1ecd62526f5b31e3584063c7a43266
TLSH
T10FF00E281CFEC106E33AAD3AC7E665BF5D37F2133808199961E801012603F028C2031B
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 fdb1b45af8613720d332f78c7f852e5f146415951b2732714ff98e14812596e9
MD5 e71427976e3561f54858d8cd4d9459b0
SHA1 0aad721ef0da34b9d668645005b95a51e69ad982
SHA512 fd6d008a5c072e91627a05944d0ca8291ce0796ae35b21646ac4b0ed40d7abbebdc9fea4be41aa89150fad84d20b82bb95609fce4766dc31a8a7c23812b24d82
TLSH
T109D05E18A3F50522E0A4C97E55D12F67EA357C159620D38807F5D7087464D01BA7171B
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 a000f12d03b0b895cc43155e1754e61c3fbcaf6c67c7126a471bb2eab30f9c04
MD5 cce36fb9272d5bac9051d47206fb3af4
SHA1 f40e3e17a905b455ca2e05fd1b72c673aa0510b3
SHA512 c7d0bffff1b707c46c728c0cbb2df03cf6a46b3c014f60a5853087c58318372244531843c179f6ee8ef9fe4097d94751c012b58dacb09c4a7b3321e06dfaa400
TLSH
T11CE05E1CE3F60A26F0C0CA3DA5E01957B535ED664710835607F0870D782CE41B932317
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e9dbf874f320d44254195de9feb8af3358db4391b5ae399ca7aaa42679cdf87f
MD5 d12767ae4fecfd01bdb9d898f9f1b133
SHA1 c27eda92f17db3f3838020cdcc7dbabf33c21fdb
SHA512 8f7a2eff060588aad561f4045167808985e017422718dbcda29b0392ce42af94023e2a9bd2eafa6f7404ec7944ad05b8bbb9e1d9e34eb801d2510ce3c094f573
TLSH
T137E02BA6C961EC2714FD276C70854645E78403472B50895F3E3E860D8FB463B419281C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 33KB
SHA256 7ed957dfb4831eeb922891f28b55dcdab924ae2d08c4592332957f0335d92448
MD5 ab12218f4857215f6352e76b8106ebb7
SHA1 baa0c26c5e282b964dc7dce4933dd3e8feefba6d
SHA512 7e4896035dab99b4e33e6ab6c642a153de33bbb4416d28651f9f08c6d909540abe2a409bb7a2aba584cfbe2c217a238b2a385b92475b986900c606fb8106a0b4
SSDEEP 768:qqFhfkEZjR/5vwRKxnmbAuYI3C+KtDunGOj64:qokYjRhYRnsuP34gnP64
TLSH
T17BE2F1AC4E24DF09BC6C28B26F56EDB1C89748810DE675A6C4462A3729D36EA0F4F4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d3d62107ee224e67441e483930890709e24704e12024c4604b51eb773ff76da0
MD5 805ed32045b129781f9cb2415703ef3f
SHA1 191fb90f62692466394e959569dfb9e6b5c82bda
SHA512 e1ec7f20132eab4199792d8f1fc9e5eefae76918d998b5ee3501f8b56dbeeb7f309d58c747c4216d25a167dcaa642cadf30188c7bd479d41c41cad326f91b357
TLSH
T151210C9590A93715CFAC1FF6909B092E24249F940DB64F7F803BCDE890832E0470EE86
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b084bfd14d77d5e43c8e98774b16cf96e6796f019591726559e709fdec341721
MD5 871852695c97d4437f803e6cb6ca8eed
SHA1 2b480b2102c443dfaebdaa6cf54503db2933e25c
SHA512 3bf4c04826afeee1566a1c101e524ba897532cec3ed2f6fa99d63b62f355af7a64bda85b8f70be96b9c98e30988aa71b69ab61fc86a07861fd089fd72d643f1b
SSDEEP 192:Dpsv1XVKLxaIa7P+bk30C07IHtIIIu2TE+r6+:Dpsv1XVKLxaIa7P+bk30C07IHtIIIu25
TLSH
T145E18DF3C3D8C66D891156F4EF15AF1ECE2A0A28431C3C66C9D8AE4B93E6871D21065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 79071494ced54be66916488e01928d8b52f2a09adace9f87452c10e938a21fbb
MD5 e7d561e9f238bce8ef41fa66f296ce73
SHA1 73a2702c5bb615a0513879ce648b176f2a7c8e13
SHA512 e15df792aa607f55849882e985b1caddf9e2aada18e18e444cbfb4ca65c93fa23224a51355fb4e8c121a836cb03840c7733ec3d5cb62fba6973bd449282f2a35
SSDEEP 192:pR6cBzm8s8BdXQOpv7tYhAPRp2h3mVf9CHsb+WNzMw31dq4Va2x3N7+acVyIsnAq:pR6mzmGdphY8XeS4wTKz2xdF4e
TLSH
T1CB62D72AAD14393B5CE7D229FC61766BD7F2102265C41E94EBFC8B2C15E79CE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1960d83cff5e96ffe677a2552f2dcf45c01421d6085add5e2555284b1195242f
MD5 d2119a49ed2ebb5db22c6829908bf05b
SHA1 1089312e761f474f545b7fd23d854b859d3cb503
SHA512 a4249b1dec313ac0a2fa6eec21a2c7e6949f567f9662be9d0fabd4878befb31c18d404057b93b88827b0ccc95741e85bd17f922797e6fe88c550039822a45585
SSDEEP 192:pR6cBz78s8BdXQOpv7tYhAPRp2h3mw9CHsb+WNndq4Va2CN7+wcVyIsnAUgtaJ:pR6mz7GdphY8Xeb4w0z2Ob48
TLSH
T1CB52C52AAA14393B4CD7C229FD61775BDBF5102131C81E98EBFC8A2C15E79CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8ea9f06d407655288efadca8a6e4ca5e45b6d533f1fce317279b64f6e822198b
MD5 d92542919f15e7d738f464e60fa43bd4
SHA1 3b6dd2c23ade2f85cb352bbdce110d1cc8199a3c
SHA512 9242a2e695aaee150c30f2386fbd680b77a15b3a4a385d6b96816ae7325ad378627071dc8563b3865ab6edc92fa171654128ab2609e326a7fb22a1b84e79ef2c
SSDEEP 192:pRNcBzm8s8BdXQOpv7tYhAPRp2h3mVf9CHsb+WNzMw31dq4Va2x3N7+acVyIsnAq:pRNmzmGdphY8XeS4wTKz2xdF4e
TLSH
T18162D72AAD14393B5CE7D229FC61766BD7F2102265C41E94EBFC8B2C15E79CE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 33d8214f01ad476a2adf8a812c7753c61529e748b53c649e27552efe56736fbc
MD5 f883488c2fcb74eb72bc11bcebd3d96f
SHA1 2c2d993e6b6f5fdd6b43aa4f45ecd820badd3438
SHA512 940b86e7bcab73cc6cced7cc4d363be7ec219d98f51f1c90b9f2f0017f4491c97617a5debcec342b75c29ef2f5d7ff33d656f8d49908f3cfc1a5483c9c148dca
SSDEEP 192:pR6cBz/8s8BdXQOpv7tYhAPRp2h3mVf9CHsb+WNz6dq4Va2CN7+wcVyIsnAUgtaJ:pR6mz/GdphY8XeS4wJz2Ob48
TLSH
T14052C62AAA50393B8CD7C229FD61771BD7F5102161D81E98EBFC8B2C15E79CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f2b3eb57409763b5bc16a1e3fe5f8dd548188d4e8294ad36d553b6fb832f9203
MD5 59c2d43123ef9d31eeecfd0c9610159c
SHA1 cae827b40f539a9ed1167c871a6f641684ee1206
SHA512 8c721e32063d7052e7b7a35ed9071c4739a90db439f1d4489fd5012f356e806a7a6107bbd6f522ac82260e88ec3598fb4cded7a32f27bc2f6f075dd7e5e54c09
TLSH
T12DB02222C0823232C08203F028A080EC30F2CF20C203222AC2E80F23CC203320028830
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ac63435f3b80ae60d96389f7e56abf9d525f51afde9aef1ef8eea39a754f537f
MD5 0013e8fd7b9ef786ccd746f32dabf8de
SHA1 eca939f01d11be1c485c9f146b4fc3e641cd4754
SHA512 90d462bf636da906c94b60491bf043ab12c21c9a9d33337b7b96d3489248049d468476d81991f4646927d3f64fe016ce1c19cf33a5f804975a2629daa3663429
TLSH
T119B0125180015642C00302F4918214887124AF10870A370993E5A9B1AC361D041141A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 409f27a82af2142817ed7e9cb9ceb2c99b4705b76e218dd813558d97eef8109a
MD5 e38c4f1b2910c3ba7b546e7517de8574
SHA1 65bb25a74111e7cde4950ec0f9b7b448de637329
SHA512 f6a61259a46208fbac1394e3904b823b7ed0107b5a256f491130aa8f1cedad86209a9ba20f88b79b61d05124bd6c263b40e002c575b1317b7947e82cb7efd9de
SSDEEP 1536:0NTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IT3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1D59312BA4E1A4AE7957E4AC176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 25b30d8cbf5f99f566bc919ea383281a956f1dde16c3e5a7e2c332eaaa0456b6
MD5 75b64c61675aa4e5c09b02d19a2551d2
SHA1 9a8152bee572eda5cfc45a4ecd2444fae3e1a81e
SHA512 2b503be1d9a2d6ad7361c429bd9c8286af84e0d3301876cc0db30b345b748cdaa23014d7daf16437799d5d51a0ec3a69db27a2dea09d64ed4580a07a530c2c8f
SSDEEP 3072:Pkt8soVJYCEPmMYvT4ryEDRiWztIyL3Qw/xLANk0mUW5GmRntSFCjEENd:PLJ3E+MYrnaMq9rOk0HOGm/SFyEEj
TLSH
T13414227E85779AE31ABA5416736D1406CD393F5EB08EE1DC108CB70570C82D9EBBAD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 8de470b35e7607185e89c06483ab02065a0cd8d3cb4b8cd3eb71432eea81122b
MD5 5de2921c7f23871d7ed514171cffce50
SHA1 5b787d9f2863d8101765cd7144bde8ca24968310
SHA512 9518bc25138a8c84112233948a1092a4d9e535870d772a005400a5c793a8ab440935dec64c3b08a38bdfb62a4af8614c535013044b4c76913f00530e9bc8a5d2
SSDEEP 3072:Gkt8soVJYCEPmMYvT4ryEDRiWztIyL3Qw/xLANk0mUW5GmRntSFCjEENd:GLJ3E+MYrnaMq9rOk0HOGm/SFyEEj
TLSH
T13014127E85775BE75AFA8416336D1406CE252E1CB08FA1DC118CB70670C93E99BFADA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 69b2b0fc7979df1cc8cee0be6ca9af7925f0ab8f65deda8c66982232e0bf5606
MD5 683cb93605832347a319fea71771becf
SHA1 efd5d997140cfa5db0c9d700c2f8ab87ae27a9db
SHA512 f00cc08e8fb5b8909dae00e3f7172bdd60eba68d247bf001e9e307b2a2f33e12a4b67407fff6268f70afa23be3296efe362eabaab0500888bca4271f1bafdabe
SSDEEP 3072:wkt8soVJYCEPmMYvT4ryEDRiWztIyL3Qw/xLANk0mUW5GmRntSFCjEENd:wLJ3E+MYrnaMq9rOk0HOGm/SFyEEj
TLSH
T1E214127E85775BE75AFA8416336D1406CE252E1CB08FA1DC118CB70670C93E99BFADA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 e32d701bd87c745ca3ed39172c58630c72087969c999153d3da1c154f88e19a5
MD5 4bc4b00568e630499c862456bca69405
SHA1 5ab72651527e23be1058a38ee79c033cd4a8bed1
SHA512 1665e01aaa2b60b74f54910890dc87a648cae42292a23903063c6cf1ea190d131f47f7a45a95082c3475048dde85cf786f32ab033659a1e78ee313cd89d3a844
SSDEEP 3072:fkt8soVJYCEPmMYvT4ryEDRiWztIyL3Qw/xLANk0mUW5GmRntSFCjEENd:fLJ3E+MYrnaMq9rOk0HOGm/SFyEEj
TLSH
T13614127E85779AE31ABA5416736D1406CD393E5EB08FE0DC118CBB0570C82D9EBBAD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1E4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1E4C.tmp
Size 142KB
SHA256 ea8946f1f6f647813929521c2a3690ec837621f04ffa201f7d582b5ab0833ab4
MD5 9e7b95219f738295eb7404e9a4013e7b
SHA1 939d3fec45acab6ae23d6ea3543bea14a6e1107e
SHA512 5ea2a601c40bec5f2bef8b73f83ff6069ed26826b48a178fa0395acd4f417b205f2eb539b6f605d40e739261112c0c2514cbd3ef2ac6b77071f1eb573f4cc5e0
SSDEEP 3072:9gKZ8Ob4WzPJ6FMngCb0xi+wCJkLcr3V6N:CA5dB10xiL
TLSH
T125E35B1BB3A500FBE1778239C9670A45E772B85117609BEF03A443662F277E49D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1EF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1EF9.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-v24.15.0-x64.msi

Path C:\Users\Admin\Downloads\node-v24.15.0-x64.msi
Size 31.0MB
SHA256 feffb8e5cb5ac47f793666636d496ef3e975be82c84c4da5d20e6aa8fa4eb806
MD5 dc465d13fcb94dcdf2e8b1182ea47cdd
SHA1 81e3cf1a9fabeb0e8469372ec4ce88a2ffb72f1f
SHA512 49266048925b0f0c44b4cfa14822fbb51786db38c421b491efd7cefb8dc5ee8a715891c7f8b5e9f36cca19a0f6ff72582b41082c111e7f7a53aef97ac7092833
SSDEEP 786432:xPcUPcgy0oIT5uz+ql33L38y7EGIjfAm++P6Nl:GGc/0oQ6+w3L384Eff9P6N
TLSH
T1F4673327F2C20977C59B4136E0A3AB11AE35BD142721459E47B0A05CFE366F06BFB74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIABCC.tmp

Path C:\Windows\Installer\MSIABCC.tmp
Size 342KB
SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
MD5 8795eed320191d21091350b952553175
SHA1 fdb195742e9066789e46424499f9984e5d27ca4e
SHA512 33785b2bd3514476d5bbe55df699c0724426dc2db54dd668d9e6b2c5e142e489c76e6d9faf40fe9de2437672bdf00292c694c4e444f99ac5789c636531bc72b8
SSDEEP 6144:yJ7qjBiG9tQFTT4U/zwWr3FvdBlGJWrmUgMzyFGfORG:yJ7ogGYFTG81vdBPmUgM0mOw
TLSH
T1E2745B366456303BE6F90D32F528CB706D3DB61827D8959E83E0984E38245E36BF375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 26408e6f2bc338ac0d9ec2e590ac27bc93f9e7d9b0dacb8014dba86e5280d6a2
MD5 7520b303eecaf640ea1235650a85593a
SHA1 de08f0f5dd1593dd26fece890c84340e83ae9205
SHA512 de3828c9a11257201c6a1b3597d3dd220bbd6c7e1eb8e49ee3ba8a876fa139214551fe83b5819cb678afaf258f8a87811cb26c4d3565882778e8dd38abaffdcd
SSDEEP 24576:Du8m+1zcdoO/vvTLr2deomap8UkzFltiBrm9vSsll068u6kA4PFUF7WhY:k
TLSH
T1EC47D82836F92110E7F79E3C78F05A13893A7D579C16DE8D05811B8E0961BB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e0d74312-4854-42ac-855a-386c3e5cd1ea}_OnDiskSnapshotProp

Path \??\Volume{9925377d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e0d74312-4854-42ac-855a-386c3e5cd1ea}_OnDiskSnapshotProp
Size 6KB
SHA256 f2e3940157e257bd5f3be1d47a033e10f2046c0a9e338d581cdc87809808efa7
MD5 621378313f82dbfec126ba66aadbfd9c
SHA1 eb086f44f7af150f8cd6b2886f2d4acbb479e998
SHA512 fb304b52246953c3558671a6cf00e9455297f367107791b0eef023b509f93393ee00a1d4f69edf1804b4a051d53044587b47304457daaaeedde2e177c551c4a9
SSDEEP 96:FQByMAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Wfab++ZVm
TLSH
T1E4D189085AF54711E2B3AB3128F14557A877B811EF33CB8E0198238E6670A14F976F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-13-0x000002CB415B0000-0x000002CB416DA000-memory.dmp

Download

memory/2276-2259-0x0000019E9D4E0000-0x0000019E9D58C000-memory.dmp

Download

memory/2276-333-0x0000019E9D4E0000-0x0000019E9D58C000-memory.dmp

Download

memory/2276-377-0x0000019E9FE50000-0x0000019E9FE5C000-memory.dmp

Download

memory/2276-376-0x0000019E9D4E0000-0x0000019E9D58C000-memory.dmp

Download

memory/3180-2247-0x0000023AFD4A0000-0x0000023AFD5CA000-memory.dmp

Download

memory/3180-2261-0x0000023AFD4A0000-0x0000023AFD5CA000-memory.dmp

Download

memory/3652-2257-0x000002AFA9660000-0x000002AFA970C000-memory.dmp

Download

memory/3652-323-0x000002AFA9660000-0x000002AFA970C000-memory.dmp

Download

memory/3652-2258-0x000002AFAB7F0000-0x000002AFAB7FC000-memory.dmp

Download

memory/3652-324-0x000002AFAB7F0000-0x000002AFAB7FC000-memory.dmp

Download

memory/4100-2250-0x0000013A28220000-0x0000013A282CC000-memory.dmp

Download

memory/4284-2249-0x000001886A440000-0x000001886A4EC000-memory.dmp

Download

memory/4308-226-0x000001A7546C0000-0x000001A75476C000-memory.dmp

Download

memory/4832-1632-0x0000022F473F0000-0x0000022F4751A000-memory.dmp

Download

memory/5132-334-0x000002B566080000-0x000002B56612C000-memory.dmp

Download