Resubmissions

22/09/2026, 22:49

260922-2rt5kahb647

22/09/2026, 22:43

260922-2nd9yays6j7

20/09/2026, 06:00

260920-gqmnwacp3v7

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1784s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 22:49

General

  • Target
    c5832c0944476b0097318fe752a54ec831572ec53fd9402f5ac04ac5f3c93e11.msi
  • Size 18.9MB
  • Sample260922-2rt5kahb64
  • SHA256 c5832c0944476b0097318fe752a54ec831572ec53fd9402f5ac04ac5f3c93e11
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c5832c0944476b0097318fe752a54ec831572ec53fd9402f5ac04ac5f3c93e11.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2960
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5652
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5512
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AAB7841FE2C8D6B68236D56312A493B5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node.exe
        "C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node.exe" "C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\cjqsk45gc5697tpe3o.js"
        3⤵
        • Executes dropped EXE
        PID:3264
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4992
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3440
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:1064
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa39cd855 /state1:0x41c64e6d
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1472
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k CameraMonitor
        1⤵
          PID:1680

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              cjqsk45gc5697tpe3o.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\cjqsk45gc5697tpe3o.js
              • Size 13KB
              • SHA256 c998f11fc0b0431be6339857227fb60ea972e615d36010b3cdb69ab97c8729d5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              m.pak

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\m.pak
              • Size 712KB
              • SHA256 f9a050778807e0fa1e0732c2ff51618eb11b445468e3205cb2ae494b04e99ab6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              node.exe

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node.exe
              • Size 28.9MB
              • SHA256 b014e4ec5ca810b2fb54cdbf6ab8d6acc488285c98469606efb8b412472bec2a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              index.html

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\docs\public\cli-commands\npm-cache\index.html
              • Size 44KB
              • SHA256 b2eb440d1d231090d52d2eabfd7b06a22332b79ea042da4099930471b060092f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              _stream_transform.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\are-we-there-yet\node_modules\readable-stream\lib\_stream_transform.js
              • Size 7KB
              • SHA256 75aabc0acf662f0cfa187ea79437b1ca4edac342b6995fe6038d171e719d3613
              • MD5 SHA1 SHA512 SSDEEP TLSH

              BufferList.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\are-we-there-yet\node_modules\readable-stream\lib\internal\streams\BufferList.js
              • Size 2KB
              • SHA256 b404455762369e9df0542e909dbda88df308d53f6abbac0b8f8c0b727e848a74
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\aws-sign2\LICENSE
              • Size 8KB
              • SHA256 c3613146372a1d5b88c5215439f22f2ba271c1f6284133bbea37887b078fd5de
              • MD5 SHA1 SHA512 SSDEEP TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\concat-stream\node_modules\readable-stream\LICENSE
              • Size 2KB
              • SHA256 b7cd4c543903a138ba70beef889be606adceefa1359f858670d52d1865127e24
              • MD5 SHA1 SHA512 TLSH

              _stream_duplex.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\concat-stream\node_modules\readable-stream\lib\_stream_duplex.js
              • Size 4KB
              • SHA256 76d5dc9dcae35daa0a237fe11ef912b89dcf25c790f4d6ba1eadc2c97e8dad4c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\copy-concurrently\node_modules\aproba\LICENSE
              • Size 766B
              • SHA256 1b94c9898885c681c1e0ebbf96494e49662842f88ac1e4dd8ffad0ac047108ae
              • MD5 SHA1 SHA512 TLSH

              README.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\duplexify\node_modules\readable-stream\README.md
              • Size 2KB
              • SHA256 42294293978532e3523e7b09172e9da9cc1c0d1bd5d04baf4b9b984ed2088d0d
              • MD5 SHA1 SHA512 TLSH

              _stream_passthrough.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\flush-write-stream\node_modules\readable-stream\lib\_stream_passthrough.js
              • Size 1KB
              • SHA256 d5e328cb2e044902c3ace9da8d277298b04bcb4046bcd5a4cd3d701e56497d6c
              • MD5 SHA1 SHA512 TLSH

              _stream_writable.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\flush-write-stream\node_modules\readable-stream\lib\_stream_writable.js
              • Size 20KB
              • SHA256 7262ec523f9247b6a75f5e10c5db82e08cfe65acc49f9c96fcb67f68c5a41435
              • MD5 SHA1 SHA512 SSDEEP TLSH

              .travis.yml

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\flush-write-stream\node_modules\string_decoder\.travis.yml
              • Size 949B
              • SHA256 8021d98e405a58cd51b76bf2669b071be7815db2c68216403c1ca02989c1ec2e
              • MD5 SHA1 SHA512 TLSH

              duplex-browser.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\duplex-browser.js
              • Size 54B
              • SHA256 bf30af3ba075b80a9eaf05ba5e4e3e331e8a9b304ccb10b7c156aa8075f92f44
              • MD5 SHA1 SHA512 TLSH

              duplex.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\duplex.js
              • Size 47B
              • SHA256 8c1a1af19eaf01f960e9dc5fc35fbcb0e84060d748883866e002b708231b46ac
              • MD5 SHA1 SHA512

              stream-browser.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\stream-browser.js
              • Size 50B
              • SHA256 0406c41a3dc088c309a3efb822e145bb78856668bd60d16b66b637f4dbf2a1ba
              • MD5 SHA1 SHA512 TLSH

              stream.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\stream.js
              • Size 37B
              • SHA256 783e5e798a19dde6981db840cad5a2bfbf0822dd2819fe14c54a1f4e71f0d363
              • MD5 SHA1 SHA512

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\fs-minipass\LICENSE
              • Size 780B
              • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
              • MD5 SHA1 SHA512 TLSH

              2015-01-30.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\fs-write-stream-atomic\node_modules\readable-stream\doc\wg-meetings\2015-01-30.md
              • Size 2KB
              • SHA256 b5108c42d95185b1b71e86963bf784ddfd123da4178d41cef052be08c6429cb6
              • MD5 SHA1 SHA512 TLSH

              passthrough.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\fs-write-stream-atomic\node_modules\readable-stream\passthrough.js
              • Size 52B
              • SHA256 cfbb763646dda37e1434a5ebc4691fca75b0694b8d89505420ba3d7d489241e6
              • MD5 SHA1 SHA512 TLSH

              Makefile

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\is-callable\Makefile
              • Size 3KB
              • SHA256 4586074dc6c5129837eb6cde39a21fc30e251c498e9fcc8fc0c8076a3af97e86
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\is-date-object\LICENSE
              • Size 1KB
              • SHA256 5836b658b3a29bfc790f472bf6b5a5dfdf08789285c2a50dd43901d5733691db
              • MD5 SHA1 SHA512 TLSH

              .travis.yml

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\libnpmaccess\.travis.yml
              • Size 79B
              • SHA256 fa37bf69fa66e3475a1d499059ff372be0e136e41923c8d6fb407f649a4cb472
              • MD5 SHA1 SHA512 TLSH

              PULL_REQUEST_TEMPLATE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\libnpmaccess\PULL_REQUEST_TEMPLATE
              • Size 190B
              • SHA256 0d2e3b0d2c6a52197998a5e9345dbb7622e5a8542dcd1ed7d76a5101293d00f0
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\libnpmpublish\LICENSE
              • Size 730B
              • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
              • MD5 SHA1 SHA512 TLSH

              appveyor.yml

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\libnpmpublish\appveyor.yml
              • Size 356B
              • SHA256 8c9537e3c45610f99f3869f6b40a1bfc7c0ae82f72534e9ed0730cd9deb2a4bd
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\lodash._createcache\LICENSE
              • Size 1KB
              • SHA256 34c9e87365128252851b101ae194a31e3d019724b20c25fa66fd4521a326c818
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\lodash.union\LICENSE
              • Size 1KB
              • SHA256 3e0f669f0550e6101efcc81d9032af5498b72eec499df58cfbf63e24a61e2f75
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\minimist\LICENSE
              • Size 1KB
              • SHA256 a9ecf3da3825b3e7232f29c970a2869bb1752c900bd75ba7cbabeb69b8f032b4
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
              • Size 771B
              • SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
              • MD5 SHA1 SHA512 TLSH

              .eslintignore

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\normalize-package-data\node_modules\resolve\.eslintignore
              • Size 14B
              • SHA256 cd429484a9e55b1df61764740f7153c476037c791b9dabac344bcce552a45080
              • MD5 SHA1 SHA512

              LICENSE.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\npm-logical-tree\LICENSE.md
              • Size 771B
              • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
              • MD5 SHA1 SHA512 TLSH

              .editorconfig

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\object-keys\.editorconfig
              • Size 289B
              • SHA256 2dc461c2ca14c593ed13101958988e6e5d6944144bb3f8f70631eb96365e9f1e
              • MD5 SHA1 SHA512 TLSH

              _stream_readable.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\parallel-transform\node_modules\readable-stream\lib\_stream_readable.js
              • Size 31KB
              • SHA256 46ca457378727959f5d2214955c03de665a22c644ddb78c568e925f725ed7e84
              • MD5 SHA1 SHA512 SSDEEP TLSH

              destroy.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\parallel-transform\node_modules\readable-stream\lib\internal\streams\destroy.js
              • Size 1KB
              • SHA256 713e5bac5e10b8d0940eda803835c50da6ef1373f1e7b872b063373069129377
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\pump\LICENSE
              • Size 1KB
              • SHA256 c222d7cd6879fb81d79a019383a6f651107d76f1f75b2632c438828b1a08c227
              • MD5 SHA1 SHA512 TLSH

              GOVERNANCE.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\readable-stream\GOVERNANCE.md
              • Size 5KB
              • SHA256 7366d24a6cd0b904b2a34b7a4c8a8f62fc855605ed0ab4030cbee5a9304f94e7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              README.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\run-queue\node_modules\aproba\README.md
              • Size 2KB
              • SHA256 da325e3fe4425fc89c9a474ae18eea542f5787151c92bb2aba9dc99de596cfa1
              • MD5 SHA1 SHA512 TLSH

              index.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\run-queue\node_modules\aproba\index.js
              • Size 3KB
              • SHA256 8059de4e00e45bad48e09ae5eec5476740b2462fbd913dcc0a055dfa73dd533a
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\slide\LICENSE
              • Size 763B
              • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
              • MD5 SHA1 SHA512 TLSH

              readable-browser.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\readable-stream\readable-browser.js
              • Size 358B
              • SHA256 d9c3473b418fbf6103aa34c716fa9d8df7ad1cf5900dac48301dc3e8ea6139ae
              • MD5 SHA1 SHA512 TLSH

              transform.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\readable-stream\transform.js
              • Size 50B
              • SHA256 62707b41fa0e51f0556a32f98c7306fa7ff2e76d65df0a614889b827c3f5eaab
              • MD5 SHA1 SHA512 TLSH

              writable-browser.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\readable-stream\writable-browser.js
              • Size 56B
              • SHA256 0d92b48420b6f4ead3c22d6f9db562a232e502e54ca283122fb383828f7b3842
              • MD5 SHA1 SHA512 TLSH

              writable.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\readable-stream\writable.js
              • Size 237B
              • SHA256 0b99c6a91a40658c75ec7ad8671f02304e93b07bd412e49540b9655f2090e557
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\string_decoder\LICENSE
              • Size 2KB
              • SHA256 9d364120560d6770fd7e663d23311f871c2c597327cd4c1fced97dbab25183f4
              • MD5 SHA1 SHA512 TLSH

              README.md

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\stream-iterate\node_modules\string_decoder\README.md
              • Size 1KB
              • SHA256 6b8a003975a1c056caee0284b9e1930192cac1bd0ea2181f594290057d2c0687
              • MD5 SHA1 SHA512 TLSH

              license

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\string-width\license
              • Size 1KB
              • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
              • MD5 SHA1 SHA512 TLSH

              string_decoder.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\string_decoder\lib\string_decoder.js
              • Size 9KB
              • SHA256 00fd7780ba199a984bbc1f35875017ae26fb8e48ef6e3e4b11fcf0954478e0fb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              license

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\term-size\license
              • Size 1KB
              • SHA256 6b18e4f3ea8443739a64c95ecf793b45e4a04748da67e4a1479c3f4bba520bd6
              • MD5 SHA1 SHA512 TLSH

              .travis.yml

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\through2\node_modules\readable-stream\.travis.yml
              • Size 1KB
              • SHA256 c3d79e198270443970b49c4f3e136551eb6c7c81a2300b931ae32ce17dad0967
              • MD5 SHA1 SHA512 TLSH

              readable.js

              • Path C:\Users\Admin\AppData\Local\node-v12.22.14-win-x64\node_modules\npm\node_modules\through2\node_modules\readable-stream\readable.js
              • Size 790B
              • SHA256 cdeb57ca548c8dcf28f9546f202763f9b03e555046476d213d571c6cb7a59a43
              • MD5 SHA1 SHA512 TLSH

              MSIE1CC.tmp

              • Path C:\Windows\Installer\MSIE1CC.tmp
              • Size 234KB
              • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              metadata-2

              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 26.1MB
              • SHA256 3297b5a691779b1c4e82ea1537218ee9082d61005552db750d334247b8d10e16
              • MD5 SHA1 SHA512 SSDEEP TLSH

              {fa3af07f-ac7c-4af3-b06d-8c3acb3795e2}_OnDiskSnapshotProp

              • Path \??\Volume{0a1bed32-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fa3af07f-ac7c-4af3-b06d-8c3acb3795e2}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 3eea7471178ac049680047ff11f6b54dd77939f7b6dc9b302a4a5492678e413d
              • MD5 SHA1 SHA512 SSDEEP TLSH