479e10e400b0a8a6e340c94d7239da890ca40d1c09fb3eea64a7051ff4b55e1d

Analysis

user interaction
yes
max time kernel
1799s
max time network
1093s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Archive.zip
Size 36.8MB
Sample260625-devcssgz8v
SHA256 479e10e400b0a8a6e340c94d7239da890ca40d1c09fb3eea64a7051ff4b55e1d
MD5 f26636e527c8c9626e9774af440ef839
SHA1 569f0eeb52b5efb0bfb1ebf45c6bbb6098cd7d07
SHA512 fcaa05fce97666d349fac764551b4cf6ef4dc2a2e2d0ccf6b7ad7c09ff51d985a7bc5aee94f492b44f77cb0a8e8d7e341f9faac767856e7c75dbead3401062f3
SSDEEP 786432:FCYsqmp14FO71Amis4iQApgbzwOg6eMV1pPVFCeFelIKTazFR:FC+mp/7emisNpgbzwO9f9VJMvT0P
TLSH
T11687338301A31B3CFAB67F3B4A62D991A3D7D209E3CDB205EAC9475700F51A519A47CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	node.exe

Executes dropped EXE 13 IoCs

pid	Process
4556	node.exe
1636	node.exe
4976	node.exe
1776	node.exe
4608	node.exe
3520	node.exe
3672	node.exe
1788	node.exe
5036	node.exe
3872	node.exe
5028	node.exe
1848	node.exe
3140	node.exe

Loads dropped DLL 7 IoCs

pid	Process
2736	MsiExec.exe
2736	MsiExec.exe
1780	MsiExec.exe
1780	MsiExec.exe
1780	MsiExec.exe
372	MsiExec.exe
2284	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
35	4456	msiexec.exe
37	4456	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tsa\client.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-stop.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-find-dupes.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\vuln.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\diff.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\dist\mjs\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\web\websocket\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-access.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-login.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@gar\promise-retry\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\bundler\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\dispatcher\dispatcher.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\index.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\esm\get-write-flag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npx	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\external\rekor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\build.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\name-from-folder\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\DispatchInterceptor.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-install-ci-test.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff-apply\index.cjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mute-stream\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-repo.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\signal-manager.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\rebuild.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-trust.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\aproba\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\dist\commonjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-run.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\root.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\data\win\large-pdb-shim.cc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\trailing-slashes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\DiagnosticsChannel.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-dedupe.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\dsse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf32.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\test_gyp.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\utils.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-bundled\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\is-package-bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-pkg.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\sort.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libesm\patch\apply.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\sortAscending.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\config.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\esm\mode-fix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\peer-entry-sets.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npx.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\center.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\translations\da.js	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DF4DA423-2517-42D8-A20A-E60AC8324D02}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC386.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8C7.tmp	msiexec.exe
File created	C:\Windows\Installer\{DF4DA423-2517-42D8-A20A-E60AC8324D02}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{DF4DA423-2517-42D8-A20A-E60AC8324D02}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e59c23f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE819.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC346.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA9C.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c23d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c23d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5D6.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\PackageCode = "8FD588DBE6AEA1346B877B5B408AAB63"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\Version = "436404224"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\ProductIcon = "C:\\Windows\\Installer\\{DF4DA423-2517-42D8-A20A-E60AC8324D02}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\324AD4FD71528D242AA06EA08C23D420	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\PackageName = "node-v26.3.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\Net\1 = "C:\\Users\\Admin\\Desktop\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\324AD4FD71528D242AA06EA08C23D420\DocumentationShortcuts	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\324AD4FD71528D242AA06EA08C23D420\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Desktop\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2072	msiexec.exe
2072	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4948	7zG.exe
Token: 35	4948	7zG.exe
Token: SeSecurityPrivilege	4948	7zG.exe
Token: SeSecurityPrivilege	4948	7zG.exe
Token: SeShutdownPrivilege	4456	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4456	msiexec.exe
Token: SeSecurityPrivilege	2072	msiexec.exe
Token: SeCreateTokenPrivilege	4456	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4456	msiexec.exe
Token: SeLockMemoryPrivilege	4456	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4456	msiexec.exe
Token: SeMachineAccountPrivilege	4456	msiexec.exe
Token: SeTcbPrivilege	4456	msiexec.exe
Token: SeSecurityPrivilege	4456	msiexec.exe
Token: SeTakeOwnershipPrivilege	4456	msiexec.exe
Token: SeLoadDriverPrivilege	4456	msiexec.exe
Token: SeSystemProfilePrivilege	4456	msiexec.exe
Token: SeSystemtimePrivilege	4456	msiexec.exe
Token: SeProfSingleProcessPrivilege	4456	msiexec.exe
Token: SeIncBasePriorityPrivilege	4456	msiexec.exe
Token: SeCreatePagefilePrivilege	4456	msiexec.exe
Token: SeCreatePermanentPrivilege	4456	msiexec.exe
Token: SeBackupPrivilege	4456	msiexec.exe
Token: SeRestorePrivilege	4456	msiexec.exe
Token: SeShutdownPrivilege	4456	msiexec.exe
Token: SeDebugPrivilege	4456	msiexec.exe
Token: SeAuditPrivilege	4456	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4456	msiexec.exe
Token: SeChangeNotifyPrivilege	4456	msiexec.exe
Token: SeRemoteShutdownPrivilege	4456	msiexec.exe
Token: SeUndockPrivilege	4456	msiexec.exe
Token: SeSyncAgentPrivilege	4456	msiexec.exe
Token: SeEnableDelegationPrivilege	4456	msiexec.exe
Token: SeManageVolumePrivilege	4456	msiexec.exe
Token: SeImpersonatePrivilege	4456	msiexec.exe
Token: SeCreateGlobalPrivilege	4456	msiexec.exe
Token: SeCreateTokenPrivilege	4456	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4456	msiexec.exe
Token: SeLockMemoryPrivilege	4456	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4456	msiexec.exe
Token: SeMachineAccountPrivilege	4456	msiexec.exe
Token: SeTcbPrivilege	4456	msiexec.exe
Token: SeSecurityPrivilege	4456	msiexec.exe
Token: SeTakeOwnershipPrivilege	4456	msiexec.exe
Token: SeLoadDriverPrivilege	4456	msiexec.exe
Token: SeSystemProfilePrivilege	4456	msiexec.exe
Token: SeSystemtimePrivilege	4456	msiexec.exe
Token: SeProfSingleProcessPrivilege	4456	msiexec.exe
Token: SeIncBasePriorityPrivilege	4456	msiexec.exe
Token: SeCreatePagefilePrivilege	4456	msiexec.exe
Token: SeCreatePermanentPrivilege	4456	msiexec.exe
Token: SeBackupPrivilege	4456	msiexec.exe
Token: SeRestorePrivilege	4456	msiexec.exe
Token: SeShutdownPrivilege	4456	msiexec.exe
Token: SeDebugPrivilege	4456	msiexec.exe
Token: SeAuditPrivilege	4456	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4456	msiexec.exe
Token: SeChangeNotifyPrivilege	4456	msiexec.exe
Token: SeRemoteShutdownPrivilege	4456	msiexec.exe
Token: SeUndockPrivilege	4456	msiexec.exe
Token: SeSyncAgentPrivilege	4456	msiexec.exe
Token: SeEnableDelegationPrivilege	4456	msiexec.exe
Token: SeManageVolumePrivilege	4456	msiexec.exe
Token: SeImpersonatePrivilege	4456	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4948	7zG.exe
4456	msiexec.exe
4456	msiexec.exe
1232	7zG.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2736	2072	msiexec.exe	108
PID 2072 wrote to memory of 4496	2072	msiexec.exe	112
PID 2072 wrote to memory of 1780	2072	msiexec.exe	114
PID 2072 wrote to memory of 372	2072	msiexec.exe	115
PID 2072 wrote to memory of 2284	2072	msiexec.exe	117
PID 4424 wrote to memory of 1736	4424	cmd.exe	130
PID 1736 wrote to memory of 4556	1736	cmd.exe	131
PID 4424 wrote to memory of 1636	4424	cmd.exe	132
PID 1636 wrote to memory of 2796	1636	node.exe	133
PID 2796 wrote to memory of 4976	2796	cmd.exe	134
PID 4976 wrote to memory of 3804	4976	node.exe	135
PID 3804 wrote to memory of 1900	3804	cmd.exe	136
PID 1900 wrote to memory of 1776	1900	cmd.exe	137
PID 3804 wrote to memory of 4608	3804	cmd.exe	138
PID 4976 wrote to memory of 2812	4976	node.exe	140
PID 2812 wrote to memory of 1272	2812	cmd.exe	141
PID 4424 wrote to memory of 4464	4424	cmd.exe	142
PID 4464 wrote to memory of 3520	4464	cmd.exe	143
PID 4424 wrote to memory of 3672	4424	cmd.exe	144
PID 4424 wrote to memory of 3904	4424	cmd.exe	146
PID 3904 wrote to memory of 1788	3904	cmd.exe	147
PID 4424 wrote to memory of 5036	4424	cmd.exe	148
PID 4424 wrote to memory of 2316	4424	cmd.exe	150
PID 2316 wrote to memory of 3872	2316	cmd.exe	151
PID 4424 wrote to memory of 5028	4424	cmd.exe	152
PID 4424 wrote to memory of 3980	4424	cmd.exe	153
PID 3980 wrote to memory of 1848	3980	cmd.exe	154
PID 4424 wrote to memory of 3140	4424	cmd.exe	155

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Archive.zip
1⤵
PID:1084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:464

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\decimal-format-utils-1.0.0\" -spe -an -ai#7zMap17429:110:7zEvent30698
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4948

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\node-v26.3.0-x64.msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B08EE23B1274F6B07CD6F2806EBBA465 C
  2⤵
  - Loads dropped DLL
  PID:2736
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CC1424CECB4D41F54C8B1124C091B1AE
  2⤵
  - Loads dropped DLL
  PID:1780
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AC54B26AFC5B7638E23233F417F0F398 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CDC5F704286A9863673D042E23163738
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1088

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:4556
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c node scripts/sync-peer.cjs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Program Files\nodejs\node.exe
      node scripts/sync-peer.cjs
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "npm pack "[email protected]" --pack-destination "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\pack""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        7⤵
        Executes dropped EXE
        
        PID:1776
      - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" pack "[email protected]" --pack-destination "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\pack"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tar -xzf "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\pack\decimal-format-utils-1.0.1.tgz" -C "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\extract""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Windows\system32\tar.exe
        
        tar -xzf "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\pack\decimal-format-utils-1.0.1.tgz" -C "C:\Users\Admin\AppData\Local\Temp\ph-sync-uVhZ7u\extract"
        6⤵
        
        PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:3520
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:1788
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install axios
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:3872
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:1848
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\decimal-format-utils-1.0.0\decimal-format-utils-1.0.0\" -spe -an -ai#7zMap31238:164:7zEvent3139
1⤵
- Suspicious use of FindShellTrayWindow
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c23e.rbs

Path C:\Config.Msi\e59c23e.rbs
Size 799KB
SHA256 12f542fc2142d9481905da5b7f771a599aac3504170963bf4e23cf504fa42ffd
MD5 8d223bcf50d8003887ade39bbea70c32
SHA1 03f30c0727d3a5f278b2f40d696ade026afae70d
SHA512 c07da61feb4e815f2ced914e442c9ac270204d394ff901e2f9e53413fb276fc47df03362344e1ce4561da94e696d7aae26750e1430fe203595ac86c420b05c55
SSDEEP 12288:c6IAjA+S59nDPNWMrhl9Kmf3pZ81a3TAT+erw27WHdwLGu38M0N:P8TACd27WH+BsM0N
TLSH
T16105A7B0ACF094DBDF4AA175B3E075384A9D6ECA7F041A3D130D93FA8E2D9B055B5A04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npm-prefix.js

Path C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
Size 864B
SHA256 673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e
MD5 92dd1b5a463374142271ff420cb473a5
SHA1 a9f946c6a8c6f273f837703acc74c367b7781a99
SHA512 5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01
TLSH
T123110017109F8AA265328ED2E78F1900F253DBEB26339041B47D9A8E8A692016033DCB
MD5 SHA1 SHA512 TLSH

Submit Download

definition.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definition.js
Size 6KB
SHA256 2c075846e81dba93d811714fd4058733554869923a9c547b861b85ed1c97574e
MD5 f13ee0e5930e372ea5cc9af62eb4fd8c
SHA1 cc19f8b7287d64f1e955f5994b5da58c92dec672
SHA512 3fd29733eb13b8593474d159ee0a006fb90a3a2341fd5d4bf9765273a1a8c2c5cc8b749ab4b06359dbe4acfbfbda2797162ba848f48cf01ad5488e63343b2900
SSDEEP 192:vQBwRhkIQcVg55urEF6WNZTo6lw3GflYyYad9d:oBwdQcVg5wU5ZU6XflYyDd
TLSH
T104E156621DD6F01209B2D371AF07E001FB26872312D69454BCEC91A12FB5AE5C5B7FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

definitions.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\definitions.js
Size 87KB
SHA256 8930aa7719bd13a43b35dc03890e1b52913399dd4946e3802fe9142867308625
MD5 113f1bc1d15fed181936408cee224733
SHA1 1e43c5cbe2234f0106b1bca67ae728daf53eff82
SHA512 4c56ee507660f6e7b30e35f771355d509bab397431f327d2a3526ee34d7b4280e6d752b08285bbcbf4cde201c7815470f921fc3f9b59bc5fbe34f8c08232c94d
SSDEEP 768:5aeBCD3EJ3NFAk+VF+7QXAWKVRYb9K0F955NgMXMs33+sgW7pOZtOuE9tZro:caFA3GBWw0LSMX/3zgWBuE18
TLSH
T1B993A50B1E5AA37A40B3C2748B799047E331973B6613643374FD92D41F3B29192ABBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js
Size 2KB
SHA256 17d5e29267c8ee308c7869662c92109b40a0a27730974fe48a646248f572e601
MD5 ec0f134e90c315591333731f06b7b9ce
SHA1 866eea13520e3512986eca574c951b1b2cca15ee
SHA512 7f95e8d30775bb83110c44ec9b9aa88d07048185446eeeeb6714eab8d4a834113605a7589515168d4c0cd4430390f2725080c78358be420e814872ab0b1ce2fa
TLSH
T11C517377E99F63A309BA4E94C6D76E43E725DBF7268161B4307DA19C470210804279D3
MD5 SHA1 SHA512 TLSH

Submit Download

env-replace.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\env-replace.js
Size 632B
SHA256 c60ea0332bdfa351cd156b636e263c0c6b22dfde396aa68142aec10a02a05af9
MD5 a1e1f4f435381c4bbbbe0df9761924ca
SHA1 95db0b3cc483c664eb57a04b49f3363261b0454a
SHA512 bbefbff5b8b6f1946d0f5d6e3a40ffc8273ae9969ace629d16bf9cf3c0e8d054a0aad19985ccfd2081f1ea17c3f651765676dc8cd78d1e1379b1a67677ae130a
TLSH
T119F00225521372D5A3F112D44D8AD1A6EE34593426AE75C2F6D4696901C1D18C7F4CD8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
Size 32KB
SHA256 6c62d0afd091ad34f1236c468924b7cc9d789ffd925e52408f5ea28875df418f
MD5 a8c42d3ce4f44779a73d1b7e1ee91474
SHA1 0285dbdfa4e226ced9a34cd754a6cd401d12bb1d
SHA512 24a9ed1bc3457e71112146446141e1e22cc81972e8547af14dc83e87a35e882ce50abf7c83b24750f0a8e76a17420be3bd0dc234a3156ac82916e91878c3e02e
SSDEEP 384:rW6KiG9UUoA9l30gXiz6dbNMJL7RhBDwQPyvfEYTKPuIh8bpyY339FisFdue:rW6s9UUN30gXiGFS5RwQjmIhU3NBF/
TLSH
T1C8E2F92226AF542394B367B4CE8B3005FB17E13B3663904C7AAD83946F719648177FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nerf-dart.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\nerf-dart.js
Size 473B
SHA256 7d0ee69ea790e4658d5029cdd728eb6375d0feed79af8b24dac99723e25cbbc7
MD5 014e5e4e67fc63e70b80f6de6f727ac7
SHA1 ae25851c771c860082f445e5c3553f59eecf6830
SHA512 5a6e22ef53e66a719150c30001b183eaa475912e2ffbc4b2bfb036cc8fd5bc7b19fa1c72cd05688b7bfb8a48392371df784c252b0f560d5e26faee55eca92379
TLSH
T1E0F0235038A1B1401AFA4331B4124D76F8B4C1607C5684C7F88D05915F93C4FF603EC0
MD5 SHA1 SHA512 TLSH

Submit Download

parse-allow-scripts-list.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-allow-scripts-list.js
Size 822B
SHA256 38366791476f480be7457e781e75ed22defd9335237fa981d858e6d6b8d392a7
MD5 7326f9d67a242c1630ec8ce7487ff6fb
SHA1 d89fae802c1fe7523b9a2f1209af7af044874aea
SHA512 32a2eba55679bda63aabf804f6d6a5890bea43a7e40d09b98c2df4da327e8aa1e846acad274e48b7eac58ccdb713f1a978fae0652e3201c58a595bb10d86940d
TLSH
T19101FD605C36722C82F627B085BBB0A0E650942A3262E09C3B9E50781F6AD782536E9D
MD5 SHA1 SHA512 TLSH

Submit Download

parse-field.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\parse-field.js
Size 2KB
SHA256 5ea7f66b8afaeb7d1dc00eb80ba7cf4a9dea3c46670dfd0208c78c72318e7552
MD5 6b943bdc3a40a5555144d4350010da0a
SHA1 0a7725a4d582e4fa0685541f11e91368fc9565db
SHA512 709ebefdeaf3c9f2472561a58dca56bc6fcbb4eeb10a46c218b8acc57b98f1274e5faf133272a7dec662dbdb7cfdf1751743cb5a438dce5961f6c21ef7088990
TLSH
T16F41CDA224A1B12729F217B8854B5024E703D567372988E4F6CD84B47FBB5E0817EFEC
MD5 SHA1 SHA512 TLSH

Submit Download

set-envs.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js
Size 3KB
SHA256 d283d0baf0200bbb23afcbb956a63163c0d73ae67bf31e1dc5647bfa0c5ab6fc
MD5 aae62a2be115706cf055fd68c33ae5ba
SHA1 e4abd56e6b4d5efbcf771c6a63fab415b258b054
SHA512 52a8d867b462c4fe25df6937e04ae036a6e641d1f1e838de3ee3694230127c7b1a3da30c3d4d9844dbcf1af8c37bacfd937a3e9e092193ef904dbc8d37d1d857
TLSH
T1F1816313619E82B305F25AB8DA4F7015EF33DA762A61E0F8316D64042FFA614A336DD6
MD5 SHA1 SHA512 TLSH

Submit Download

type-defs.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
Size 1KB
SHA256 5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648
MD5 8385a8a608e5cdd5a79957a6c979fb28
SHA1 d20fd55ae3664cd339245fdd26a28983baf97f2e
SHA512 3bec37444635d9cdc9a2f1224fa9160213fc4dd1234e98080c7ec825f07785ac93d4a88bf8bb4bb91470ec070da9b32acc20b111d2d3fcd15397a8e641dd6eac
TLSH
T10A3184415DA1B0410DFA47F858A1C753FAE683216211C08BF8BD12222BE2FD590BAEF0
MD5 SHA1 SHA512 TLSH

Submit Download

umask.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
Size 949B
SHA256 9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68
MD5 ae8c8f3d710c2c7a5cacbcef9c6f9646
SHA1 3fabbd5fcbeca40267f54aa7f523afa573062ad3
SHA512 94d94b24e7eafbf499923e92020ed5f7bf8aa606f3031ae4b99fdcabab2625a3bd84c60d6d1f236509c5281becbe06c697911db10dbc2b014bafa3903b5f00ce
TLSH
T141119C09AE9A26756B336BF89C87A015F9BAC473519800ADB46D01407FF8C7884B4FD9
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
Size 1KB
SHA256 41092256bce446198e3f74818496f137876a0eee7a9d0484aaf4222663a2655f
MD5 ccd90ec7ce96a873a4c1c51f38112c22
SHA1 5125bc0996cb1854a34a2303f204319585f15a3d
SHA512 944da50f04eb7646fa65c78941aedda65f029051c768cfed319f1bb190c915c21a09d4215ef8f12af78f057ab2f48a9e3b0096ae417853f83be9bfb31df11633
TLSH
T182316563D8A9CEA327B5139BAC714A52F1244B2F0565D80F30F9434C0F7297302ADB98
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\lib\index.js
Size 1KB
SHA256 d12c4a8f9905d3518963e66d6568b0c8dd1f0c61f5b8bb5fa517fb015b3626b4
MD5 dd6841a20b86546fabef0fbc5e4f06fa
SHA1 cbad034e03057042d32137d6efbf06073dea0ae1
SHA512 4d47e762dc46be5d946b8c71a6902a9dc5e8111c04be0cc1e84af5ad74a7ccc06f7da98bc22eb6a14b115579994bc1169fb298b32c3bfacac298b9b11b874c11
TLSH
T1DD21EE7062AC051AE477B3B74987949CF57FC53730008618BA8D66901F34996C2F9EEC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\package.json
Size 1KB
SHA256 e7671569440b427332662fceb1f4145dbf935e8e37e1da8333710af6b6e564e8
MD5 d6342a82b6a40083880d61906da64ae7
SHA1 defb659c2d0cb7559bc474da62937eee2ffccaf0
SHA512 2b1994249848d2329d7b36ca74e5c3718190ef0df2cb3b01b8e3e24099e1aa8b67b6715b4b5430ddded0541d77449bc11c75bb177994a896d76caab900265004
TLSH
T16A216842D5A58E633AF6536EFD244252F224871FCA95D81BB4F4029C4F612331199BA8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\index.js
Size 2KB
SHA256 1d0822329d3b3fbe506f50e920884cdadc8ff0eb133a03f9503d2030f19e30cf
MD5 d8c9f5290aad9a4c8366cc0a544e4636
SHA1 642f4d441d6ec53c1a7b047efbe151e91b242766
SHA512 5406be693e0da00527e53f9db1e9743ef4bbc1972670e05a3160c287264512d97f49008a14030dc40d651cdda5a77db3b858565b505766022de6e073fa32d94c
TLSH
T14C51244E296B614A4BB777A0C71BE447F6373023131168C975CE96906FF0209867EEEE
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json
Size 1KB
SHA256 52190c0fd963f64821da5073e286e89af323712e8f1ad48effa2a496dbb316ae
MD5 3d777bcfa8ec2bb238cc599353a6cdc6
SHA1 688fc2c6abd61a26635aa0b0f334ade4ff5fb89d
SHA512 f1e3e9c25ef0e8f93d7fb5565de1b323cb2a41cdf45e912b6d0c39cf4ba6c4bcf206a9ef8a57c0a66fb6e875e94a9f395d3f504c6d41c692c400115c6c7fe150
TLSH
T1E52121B7DA505D330EBC5FA2ED69650AF2225B2F50A08D0F70BF411C4FB656314AAB2D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

ini.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
Size 7KB
SHA256 481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad
MD5 84b82e208b562cc8c5a48cf65e6ab0f0
SHA1 0adca343dd729beb86ebbb103f9d84e7ebbd17af
SHA512 377034e60d9d2ef3da96f23cb32f679754a67d3cd5991b1ad899f9f7c1910dcd0d9b0a1b0530046b6016896bd869a1607ef29c99949407959dcece6f9da790f5
SSDEEP 192:Q0ODCk+ZoW1ZdLSgKPiMDni6LJQqLDkUw0GIyRlQjiB4giPnU0r7ZnB2:+ih76LJJHwpWiN0rJB2
TLSH
T112E1635835952064463773F29D57A415FB7A6433B121D08879BD4AC02FB1D20A3BAFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
Size 1KB
SHA256 eb9b0b3af32079c90fa9bedeb5539c8415b817eafea0daf113384dc93276c587
MD5 cd633eeec9ba8da5ddc366fc82375eb8
SHA1 842938e8989e6e9afebbee30399ebb9ecac180c2
SHA512 a674aaecde2d2b150fe6bb583b8ee81bc0e2db32c11c7b036a89eaf354fe440c5c45a8f0b3b708d2e4fb42fe1372951d1ca4efa7aafed53fd6b46545ee048c8d
TLSH
T100113D53C5E99D632BB913ABBD744A46F1248B2F0555EC0B75F5024D0F7207305ADBAC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

debug.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
Size 186B
SHA256 0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46
MD5 1d97bc3d56be902d4f63b37b05f3ad85
SHA1 ace1fd823fc44e12a25448db2b5a49e20973e506
SHA512 fb52fee500d9099339b4d60f9aaab8bf613e7387848ff6ef3d2ce513d886298ee04810fb1f2b107a317cf4e1cea60a26ff4797b9cad3b11bbc26af0852e684ee
TLSH
T124C0221256A42610C2B007433B19CA9B6CE83A2603A2A010F238624F2FC55714426CCA
MD5 SHA1 SHA512 TLSH

Submit Download

nopt-lib.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
Size 14KB
SHA256 fb1225f5af7ce00c5eca903e3ed53a450cc1891d66bc6c06fbbd29973c30cc92
MD5 7c17123abc6f7a3d291172ec70c4497d
SHA1 76004ffe635ef64380e2ba0e6d2e6aaeb0cd2588
SHA512 feff76a134dda3af0af261f916fe3ea2efd00abda41b7a7d5938130d8609d4b6c097d3efa297372ebf7f9668d76be53c2e732726567e679d67344b6e5a599550
SSDEEP 192:MoC2gi6zgKNqHO3M1iy9Env6WvT0LYxuBSvfKUdEuapGcANx33NL8D1/lENnYAKa:2tgKWOUSlvfFVVvtU+VBj
TLSH
T163623E1C3A4462A14B7363B5CD47A81AEB62C1273324E894B86C67702FB5475E27DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nopt.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
Size 1KB
SHA256 d65dabbe6a6f823df2548a9e791e8a768d92368e92fdb7e9ae32fee80aac08fb
MD5 b21be1551a71384366014ff42fefdf96
SHA1 dcfda8b4daf56a502d9333db746b6c6355411e6e
SHA512 b26b036107b6f03a3fac249a8fabcfb8f1a5375a4b7e493c82662478525720177b89a539f40981330a9986f70e516be5da51b7cfbbc8e0319086c2b2fd13cbf7
TLSH
T19221B14D9A89F4F453310240EA494A83EB96C675F32034A1B03887711AE6C3D7B14BEA
MD5 SHA1 SHA512 TLSH

Submit Download

type-defs.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
Size 2KB
SHA256 6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5
MD5 0dd63ef9ebbb7c6f5a20aaba3d799be6
SHA1 bd7d41bbdf8dce506c049cdcb339c6015fb11290
SHA512 b0f065c9749023493720f1102b7bc1b2506f449c67c57aba40aff591f6a03a8640149e9573bf0ce4a7664909b721d893b85e350fd488e6de6cb8afbb10d76bbb
TLSH
T16641A3442A6125665F729BF49CC7A607BDE79026331590BEB168989037E1FF4A038EEC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
Size 1KB
SHA256 4e2cda6365536a7e958a6a91dffbb890e3e2f9e03cefa43f32ac5b0da9511ec1
MD5 18d9f4c369ab3bba41d366b983f5ace4
SHA1 8edc31a6257b9778f20a8d2858a42d899da41be6
SHA512 3a52e8a0dd9b218886d4be45310b655601b694b83394aa39fe31913129f3b6bec74b8a126c16a4295cfed9246923d89c1e14cf6ccf2e34375ab98fcebda48176
TLSH
T11D213663C5E48D672BB913AABC644B42F5244B2B09A4EC1B74F5024D0F3247306ADBAC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
Size 3KB
SHA256 10e6b00110d43b24f6b9fc7de93cf530a8f931e18be3900f478f21dad2fe2579
MD5 bae9b768e9a7ac8d7d0f25e4be62ee79
SHA1 1565b399e0dcaa7f43bcd47c83b38dcd62cd393c
SHA512 8a0b0936ec2a541d5b34349c903b3e65818b389b4c13430c820ee4ea0bea35b31d9fbb9286bf5c92d4249c17b6e460a544184e41ec1fdf6d33a24e0c3b954675
TLSH
T10F717B5B7CE734459AB3F277E80B6686F9591B3711230876787CD2606F3A4245260FDC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
Size 1KB
SHA256 132b6ca5aec09465a17ecf2e95ecffc01fce34e3a7911c784ad624e4e065c6f1
MD5 91fe78ea8d2a4e8e4831e49e78610e87
SHA1 1e0b4269b6f975b3660e323cab02baec1ba06c89
SHA512 e9aea2d5360cb73dde94f6a83ac1d46352745eae581a30b91460d072e599c9522eae28b6710f040fb7e47d18c0fededddb7289052d4ad07362572d37cc26b0e3
TLSH
T1AC219E67C4EA8D732BB4039FBDA44682F1244B1F5994EC1B70F5025C0F7243305AD7A8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

semver.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\semver.js
Size 9KB
SHA256 0c3c0e4894b4765a9df6f8e586570efb5927102751bd995073bec396aa0bc5c0
MD5 c2568f78bdf5cc2574ed1b1ca06c8649
SHA1 94fdc80e78b67e070ac18d3969b16a7300222126
SHA512 37c99ae04333b11fc7fb2c614bed366134b0f672130aa18ac4a2a22276e13de280370634f2df5a13a450d197d8ca87189cd811945fa031c1bb53bdae4280a659
SSDEEP 192:J0YP3TG095KhrLfDxhXFWzbHWIVsbzN86:tJE0zbHWIVsbzS6
TLSH
T1A312DBB627E981AA85333375DE529008F73A847F4712912E795D46803FB30B483BAFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

parse.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
Size 349B
SHA256 4b2540c8f89bed8f3f158a96100b7ee5a905cff8b39f63317179ab5cc71e5f6c
MD5 e2606b3d581ab501155c5ac401097120
SHA1 3eca7600caaf9b3dfd302c96e87cbb172840b820
SHA512 c6a809fd7ff3048853e1ae05bc57c1033cc2b7695fe2f4292e10a1ce8a50e1b81f5509fe040feb5064c6fc2725605d6a32c4c6b02770c7ef5651c2a7059fba7b
TLSH
T1FDE0DF990A66A27B16B2AFE8C0096409F7A7827A312A4010B08E41662B5185C81EBDE4
MD5 SHA1 SHA512 TLSH

Submit Download

valid.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
Size 184B
SHA256 f29c937a2e4d31a159761632dfe3a789f8e02c6ef1afe2d89f2918556c8d5c3b
MD5 04795be2f35057eb5f2f1dc6f4deee79
SHA1 18ccb4bb88b387c9db67a77cd7ba2902db55ed0d
SHA512 33ae24d2943847a3160ed75e87f5a67699a34b48a73e4510ef848edc999de49414021843fbea2b194b20aff363e40d7cf0e4061fe50d9fbc959c73f685d2eb27
TLSH
T1FDC022080025E1AB1E8297C0C4949416C3FAC024300A50D3C30E00C0238388882A3CF8
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\constants.js
Size 910B
SHA256 83ec2d950774e5045dbb1a8079a810276905a8e9a76a60ac2d58506c46764c83
MD5 6c20e16a0625ad62cca316025b1fa879
SHA1 808f41feb3f5ffccc1e1d4a9e41b9d33a739d4d9
SHA512 1761a1fa3f4f3acc635f4b34d3cd09d9a18035907735f40820d5d4b2e4881d2ae88feacdc206df3da22ae36d937279e67db127a72f5047e9cbebaf79e50c3989
TLSH
T18511CC7A85E8177391310FC45D3ED200A725867071FAB9BA797CCA8909C7919C5ACBF8
MD5 SHA1 SHA512 TLSH

Submit Download

debug.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js
Size 251B
SHA256 a1253139164d187848c43dcda6c5b09ccb6d76cbe4df03414bf57424101f422c
MD5 b8366447df5db7a3dbebe1d1bf5dfb6f
SHA1 b985c55c1f050d36fad97dfaf0d2e0f17667e585
SHA512 88a00ce00973b2298f1ccc2a57a1249e93cb9059e4537c6620a531e025d45bdb0e74b0323e5ebb5e422a3b779a1ee909989dc12aab1911626fb128e4b4693915
TLSH
T11ED0970ADA6EA88903F023D3B44020D39CEB283117714239B828F2660F85E900D6339B
MD5 SHA1 SHA512 TLSH

Submit Download

identifiers.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\identifiers.js
Size 554B
SHA256 1b76ab27e1c123cf69eba8997d3dd06dc4aec8dab53463ca6e84e484f7884249
MD5 a5238564ce2a3a5555b108df4f4a6ad6
SHA1 3485d99a12ce8868b31b8eefc612e82c3329a6d0
SHA512 a6f6f205209ce7d4ba6f211c46558ba6fc3024df6d03c7fe0dce680228d5905084f35dc120477e4721cd5d68486c64388135c5632b84a2c44064218789e88f82
TLSH
T16BF08B18E8CA606E18730FD4C116C044FEAD453331167151779C49014B9E210B3F1CA8
MD5 SHA1 SHA512 TLSH

Submit Download

parse-options.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\parse-options.js
Size 355B
SHA256 1060995308399661110883096002bf1815b82a14c7552cc8b8445d0d79f3bc22
MD5 af6a457237618f9720c98d009153a6c9
SHA1 d143382b979b3cbaf36b7f14500b9c33fd7be056
SHA512 212316aed5d60ba41d62b1d43fbe765749fe0d01c004ddb10f94143e840c89c822bf1bc68776f42d1861f960954919fe4d3c28767cff58f8678156fd7c79c118
TLSH
T191E0DFC02886B36242F3FFE49A419049FE758332300CA4A1708DC7E42A07A18C2A7C9A
MD5 SHA1 SHA512 TLSH

Submit Download

re.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js
Size 8KB
SHA256 7a481d8764e268dbb7bb9de205524e9402d06ddfa360254a3c4e8b4b057357a0
MD5 4bfb4b549283db6e82836ab72a1ce49e
SHA1 592d1b1bdd402e7985349630434dcc54d6974114
SHA512 0f61f4bd862ee40c4c605c7de717c800a05ca223f65ae7e99043c65064d6af6897fa53e96de5d38113948868dfb65afdba594072aa4f8b85e4e5b32adedda8f6
SSDEEP 192:i9o7tzcY7JGGfK2VHWxWj6/v6v/jxQlMyqVdbrR:i90zhJPdWQO+jxQlMyqbbrR
TLSH
T10202440F91C901B142A5D6F1A4F06118EAA752BE743AD13A3BDEC2DEC3C394A417E53B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
Size 1KB
SHA256 6175334ad823bd4b8c93060422b7a446c52b25a579042277507ddcf60873b172
MD5 9ec81c16452c9096839297cd2215d026
SHA1 a9c5935c28f70546dbda2d963549825a24766ca7
SHA512 868105802e07373c6c14f3357bd93e169322b2e2cdfb1857d62ee9cb6b4795d35ac4601d8ec0d1d923cd16b0523705e390293c97b6e5609df5e9ce5f222e4292
TLSH
T162316733D4E54D231AB95B6EADA54A46F224872F19448C0BB9FD024E0F7323700DABA8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\commonjs\index.js
Size 474B
SHA256 4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036
MD5 54bd6e9d21ed6021e374d34cfaa3290c
SHA1 e71ef5c7bf958f1599fce51cc98a73f849659380
SHA512 7424455a64824b7ffe72c3ed521684d7ab279b4cabb0fc018e9db04662a92af9187efe30f5a442c3418705895262de6e057858c3cda00c634df3cbc6eebb2407
TLSH
T162F02B9988B0F476C9717BFAC6574444D59780F372450855F69D05908F31C8851ACE71
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
Size 1KB
SHA256 3a3641a678348a7becbfe5840320fd51afb843d5728efba222fa133571e17395
MD5 c47eda54bf69a98f33a56f4ba8b6b246
SHA1 903828b944edb1799990a0e9cfa8dd209a63e73a
SHA512 755a1805d71a3ca8e599fc0b56b3e7e237b1f39895fa86a6c6418ac430809619a89ba35e645c0ad7b8fa13622585d26eb89cf4beeb421ab21f2c46ef1d70cb9b
TLSH
T12031ED27D8D48E2306B42774E8651A02F2361B2F51749E0734FD222D5FB2967018FBED
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\package.json
Size 6KB
SHA256 c9e4dbbf3a23089937d9ee161b59b6ab6368a54de5663167c03bd45062afb004
MD5 7d2511eba5992669c7d64da75fa4965e
SHA1 ee4112a3fa76828068384e5d0ea804a418ff4bed
SHA512 8c96df124422b9180c10a7d831e305e1e8c3d5f386b315cd8dcdc8463fb5d020bdeb8c2050922ad0de34496e9d26d31272c78751d7d47f8f7fa146de91e3cff4
SSDEEP 192:e/aCv/QIYUDHGFXK9dryayoeZ20l/ZT0Ybb7k:e/L3QIYUTUX6ZyhZ20/bo
TLSH
T140E1EB33CC29CEA32E7A9A9EBCB44102F128435F6105D44F32BC9B8D4F72667056A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npm.cmd

Path C:\Program Files\nodejs\npm.cmd
Size 538B
SHA256 21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8
MD5 6895fc6423c97fbf721a71333137d1ca
SHA1 e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e
SHA512 0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0
TLSH
T1A0F0F6B6F8E94EECB11B0F613C76482574CBB4573C6610E6262C8514C7E46E004C235B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Size 167B
SHA256 173680c134549e02fdc0d88c36f1c09a0e8085ba9956441eaa99fcac7cb866f0
MD5 63b8b2821100582b623fe91d285552d0
SHA1 aa6906e4ff1debc4ae71c7d749b8f038948d4ec7
SHA512 310f667c583881d4281141b988bfe895e44f1cf3167bec3bca0c9a6ffd6e2d746ac56e181bbe70dd6538b8e995b9ac7996e6604cd67a6b3370f9d30a0aa21df7
TLSH
T1CEC0805D8609C16AD3410547C061FC04E80F79E60CDFC41D12D8DD4F9D45050C40555B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js website.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Size 133B
SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
MD5 35b86e177ab52108bd9fed7425a9e34a
SHA1 76a1f47a10e3ab829f676838147875d75022c70c
SHA512 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
TLSH
T1CEC09BAD49098155D3424547C071FC48DC4E79D14CDFD45D5294DD9F5D84091C854569
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 6KB
SHA256 ed4d304e313a9f019a306520fdee98d4864f606aec88c3ba652eeb416a120fb5
MD5 22fbf2f77b13aaec932f99c283b310ad
SHA1 8d29810c976a81505211564cbed4805679ee79af
SHA512 6504e179bd64edafa114c4aea613349f4d02cbd18525c59131358f32f1a886602d22a550885f09aa8cdb3fa079762719ee784e599b36b8e14a91c81bc6dbba93
SSDEEP 96:NDEZnYaCRvJn0fvmH6UqjBSpeYYaMk9SwLhIDlJhN10CXUNpXYNA9:7R10XyqjYpjYaMk9QspoA9
TLSH
T13AE1F9BD6A0CA99290E16D71CAD39FD7DCF614A43BD1E21F45256F881428FC3CAD7282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 1KB
SHA256 4d643b62409cc445919fd2b63fd87b528bf33b62b4814b0be4bcb3c960ef1457
MD5 bba8e5b9a189efe4a4d55f050066eef7
SHA1 28523318c0b314eb839aebd07a6e9bc3f68c044d
SHA512 8df1f0e71a45b78e23260f95c993bb5aff31fb46b5dc1afaf5116c3611f0630d62d5a9d5b69e2bc5018ea90d954e24b9b8c255042132b10cbc1da38bd4ad6e39
TLSH
T1F431EB579EA13051FFC288138AD449A6F5B04B7BAC700D1E110FE6F81445FD19F1004D
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 345fe296fe947276fc22f3a6e971fc4dd6c54869e2b898e7d5311077976c6691
MD5 a199ec033f0a1077b0f84f20bff9e427
SHA1 b5b860f87cb16bf2b747ce1c9a24c2558c249468
SHA512 ef3436c0ec9ad536f39dff5b34634a95095c73c7655bbeef006523c2ec52564e8061ea891afa795df861e184b845b32dc76c67714c20e91e4e7c88a1d7e2fc7a
TLSH
T1A2014162A53CB24945410949AA38EDCA7AB4EFD40B10382F207B61181665F016A36144
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 290B
SHA256 18bad1d17becd6f9af7f5452f34ca15ca0ca81532c13b66fa5e0097e3cbb9267
MD5 66499c01dee10756947e09a47a2dc7f2
SHA1 d7c4b32deeb581f7cd825149408412f924482ce9
SHA512 8f388f13659625cf506d55edab167369ef72574a5a43b65bcdc264063ec0dce75f81e0eeef374b7f713fdddfdb127ac23ba4a9af7bfa6ffe1a08295a03574ad3
TLSH
T1A1D05E18D3F64225E040863FA7E01923A976BD26890293440BB4C318B4A8D15B930313
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 9ba7de53586b56092567e29f57e3522c77b3628bddd39f88efec77b0f3d31118
MD5 d429ba5947ccd1d1432c9123822a9a8c
SHA1 21fe42cb44cd959f1c0e0a84c5b03e44f5045995
SHA512 2817b2790bb68f1168d94d8c5bc916d75f499c27477e6308e1c8c6dfced73187ad27aba2117931981afd7072bbb0e05e19f438694f599d2ddc74d4a846b2b981
TLSH
T136E0681024FEC91AE3366C3A4BCE6D2F193BF31308085BB272500123640AE00CD30722
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 46f1a24e9006c3df376070df6bc0ff07075d7ee4b32d7fb17152d7f2d89fb5a2
MD5 4e6bae0ceaf2ae3d98e9f8950c76fee5
SHA1 a729e29e0fa926f06af76a2e4706f79832c67c40
SHA512 9f84ffabc6382d00207141a79a0eef6d2a18ec32ec7de085b494764911a96cb7b579d2ccc57fbee6b397dd108d6edca243b777fd718b18b86136b09152345086
TLSH
T10DE0170CB7F54A22F181CA3E66E02A23B939AD608A10834817F58308753C992A930317
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6F2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6F2B.tmp
Size 142KB
SHA256 cd421fc04760966767599e6c48ce2ab7ead768aead11a785185f2e67b8f61a8b
MD5 2875627f4d7b0f918a6cdb69f87f7fce
SHA1 5941fa0fed7552c93599cab39ac582813bfc77d2
SHA512 e5292f9407f7d347c5f9fd0278b67f54d9fce007378c1761408d8fe4dd9acced995d1198dbe25e31c1bbce5d3485634abd93e4bfd04e3478c22d9799cb63ade2
SSDEEP 3072:bqrbMw7g/wrO6sMgpZEHinwCJkLWrSYfS/:WrIrdHEHiVf0
TLSH
T1F7E35B1BB3A500BBE1778239C9670A45E772785117609BEF03A443662F273E49D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7007.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7007.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decimal-format-utils-1.0.0.tar

Path C:\Users\Admin\Desktop\decimal-format-utils-1.0.0\decimal-format-utils-1.0.0.tar
Size 8KB
SHA256 2cb11fd47348c394002887480e93a1821504d16357337ecb142d870df8d48aec
MD5 ec858e1150de75f40d0db2d4228036be
SHA1 4c8df64bbb35a7d7031f96db3fd505e882f5a912
SHA512 91e59c0a6a6dc0c25b610ad18f65bccd06d763c2c5004d08a07ecf68fe011afc1681d3c27836482611d55927fe2ef63b3fc5e42990cdc5702b815fbdd51a4e0f
SSDEEP 96:ItobUzs9h689Is+G8LEwaafmc7bY7n7WQJoUoLIDwYtWQcFA7jQz7jv:IBssIwqc7bY7n7WQJoUdtSA7sz77
TLSH
T13302C54756A22A36CE7117F07BAD312AFA2F7417319196D2F0BC41901FA28714176FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\Desktop\package\index.js
Size 65KB
SHA256 d289529b29f6e3d12243a5f62bb3b22b8a3ead11672dc29295ae12cf195b1280
MD5 1bfccae5df3573d05adae092607f8866
SHA1 bc4cf26f56d5ee32e49fae8f17115f8e2503069d
SHA512 21da35d22254f125dea9d3cba9bc7d85b01869f802a7a1062eed02bc69556639e8272ef305d1b502dd2fe5e816f90d60e8c13326a29062ca670be624f0d1d13e
SSDEEP 768:as0TpX2W1yHMfd3GmMLglWeFsL432tG2+vqZSEMo1scWsebwqkJT:C2WqYMLglWeFs5G2+i1kseTkt
TLSH
T1BC53D78E16FA2232C1A3B3E95A5F50117939C483350ADD887BDC47482F5F528A2F5EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE819.tmp

Path C:\Windows\Installer\MSIE819.tmp
Size 342KB
SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
MD5 8795eed320191d21091350b952553175
SHA1 fdb195742e9066789e46424499f9984e5d27ca4e
SHA512 33785b2bd3514476d5bbe55df699c0724426dc2db54dd668d9e6b2c5e142e489c76e6d9faf40fe9de2437672bdf00292c694c4e444f99ac5789c636531bc72b8
SSDEEP 6144:yJ7qjBiG9tQFTT4U/zwWr3FvdBlGJWrmUgMzyFGfORG:yJ7ogGYFTG81vdBPmUgM0mOw
TLSH
T1E2745B366456303BE6F90D32F528CB706D3DB61827D8959E83E0984E38245E36BF375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c23d.msi

Path C:\Windows\Installer\e59c23d.msi
Size 34.5MB
SHA256 6281387dd8c022fd3191de23904587815c3fac3e6f91b7d36538d889c4c6f6a2
MD5 7dc17c6bc6a4d11fe3d3f8c8ff4e02a8
SHA1 c0c22fadad09cec88df7c84a09b302ff82bac4ff
SHA512 8b7bfb3034823232ca87c393d77d6a1a9c3fd65823a28b89b098a4bcdce3df4bbb3d473d84f9008d6db6f8a29daceeb29f3a59edfba4e702222fc0b91b5d5e85
SSDEEP 786432:Z8W/HDlrtK4OMt0e5fgZcZv7UhMNLHw26H27PSEW13B:Z8WZro4OMBfgZcZv3H4M/W9
TLSH
T1CA873323B6920936D5EBC136D063C791AF3A7D14371055998778A05CAE322F42BFEB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cba099fd3b651adae5620b1c27623f1b5d7cd8a6996787141e9cb92efa9c0c98
MD5 cbccfc8dff832b44be500c59466ee209
SHA1 9392af71458576e05e0d1422e1100ee0a51b7a9d
SHA512 e36415b71fb0c28faaeee16f985e4d32f6f9515d3fdc9b80f47ca0777f7c6c9459c35f6d3af10ca61d72156f63a03e0405a65f3fb8a36e39b7377983d5c8bdc8
SSDEEP 24576:8u8m+1zndoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:k
TLSH
T1AE47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6d262b33-d1e3-42e8-9839-ca06e333bdcc}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d262b33-d1e3-42e8-9839-ca06e333bdcc}_OnDiskSnapshotProp
Size 6KB
SHA256 6d5edc17b397e3e6c4a1557f971a30d211c2352756969f01b06f24d00522491e
MD5 426ab9825822ebaedc441168e8d3be88
SHA1 b2af2969b2cd2119ce344e8167b0dae353df486f
SHA512 f188b48d0c3eee64df64e6606c5c8d3ce19619ded01459c41a0976ddac77ef83924067abbb17ad2d485dc1b36bad37f8c62b370b8b6f578152850eac8471c20f
SSDEEP 96:FDBJnGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:9vGPGnb++ZVm
TLSH
T103D189085AE54711E2B3AB3129F18557A877B911EF33CB8E0198638E2670A14F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download